CISA Adds Cisco ISE, PaperCut Vulnerabilities to KEV Catalog

The U.S. Cybersecurity and Infrastructure Security Agency has confirmed that attackers leveraged vulnerabilities in Ivanti Connect Secure and Ivanti Policy Secure products to infiltrate both federal and private sector networks. These are critical vulnerabilities currently being actively exploited and hence warned about through an emergency directive.

On February 2, 2024, the CISA published an alert referencing vulnerability CVE-2023-46805 as well as CVE-2024-21887 in popular VPN and network access control solutions from Ivanti. Threat actors are able to bypass authentication and run arbitrary commands on systems they target, thus gaining persistent access to the systems.

The agency reports there have been several instances where web shells and malware were used by attackers inside a compromised network to retain control. Federal agencies, critical infrastructure operators, and private organizations are affected.

Immediate vulnerability exists for those utilizing versions 9.x and 22.x of Ivanti Connect Secure or Policy Secure. CISA has required all federal agencies to ensure patching or mitigation measures are applied by February 9, 2024, and recommends that private sector entities do the same.

The first exploitation attempts were noticed in early January 2024 with attacks multiplying towards the end of January. Victims include government, defense, and financial services sectors; however, CISA has not disclosed specific affected entities as that information is not public.

These vulnerabilities permit unauthenticated remote attackers to gain total control of impacted systems, thereby posing significant threats to both data integrity and national security. CISA’s directive highlights the level of urgency since the flaws are being weaponized in attacks even before organizations have time to patch them.

CISA has listed some steps for mitigation which involve applying Ivanti’s patches isolating affected devices, and carrying out forensic analysis for any evidence of compromise. The agency also recommended continuous vigilance for any unusual activity on the network.

The FBI and NSA are assisting CISA in tracking this threat, however, a specific threat actor has not yet been publicly attributed. Organizations must act now to stop this breach from getting any worse.