Remote Code Execution in Ivanti Connect Secure and Ivanti Policy Secure

Successful exploitation allows a remote authenticated administrator-level attacker to execute arbitrary code on the vulnerable Ivanti Connect Secure or Ivanti Policy Secure device. This can result in full compromise of the appliance, including loss of integrity and confidentiality, and may enable further actions such as configuration tampering, credential access, persistence, or use of the device as a pivot point.

Apply vendor patches on an urgent basis, especially because Ivanti noted that vulnerabilities in these products are continuously targeted. Until patching is completed, reduce exposure by restricting administrative access to trusted management networks and limiting remote administrative authentication paths where operationally feasible. No product-specific workaround beyond updating is provided in the available content.

Upgrade Ivanti Connect Secure to version 22.7R2.4 or later and Ivanti Policy Secure to version 22.7R1.3 or later. The provided content states that Ivanti advised customers to update vulnerable devices immediately using vendor-provided software available through the Ivanti download portal.