CVE-2024-21893, a server-side request forgery vulnerability affecting Ivanti Connect Secure VPN gateways and Policy Secure, is being exploited by attackers.

Its existence, along with that of CVE-2024-21888, a privilege escalation vulnerability affecting the same Ivanti Connect Secure and Policy Secure versions, was revealed by Ivanti in late January.

According to Ivanti and Mandiant, CVE-2024-21893 is actually a new technique to bypass Ivanti’s original mitigation for CVE-2023-46805, another authentication bypass flaw, which has been leveraged by attackers in conjunction with CVE-2024-21887.

It’s been a bad month or so for Ivanti and for organizations using its Connect Secure VPN gateways.

First CVE-2023-46805 and CVE-2024-21887 were being exploited and Ivanti only had a temporary mitigation to offer, pushing the US Cybersecurity and Infrastructure Agency to order US federal agencies to “Disconnect all instances of Ivanti Connect Secure and Ivanti Policy Secure solution products from agency networks” by February 2, 2024.

All four vulnerabilities have since been remediated by Ivanti.