A second Ivanti Cloud Services Appliance (CSA) vulnerability has been exploited in attacks, the company announced on Thursday.

On September 10, Ivanti announced that CSA updates patched CVE-2024-8190, a high-severity OS command injection issue that allows unauthorized access to devices. The flaw can be exploited for remote code execution, but it requires authentication with admin-level privileges. 

On September 13, the IT and security solutions provider announced that it had become aware of exploitation of CVE-2024-8190 against a limited number of customers.

On September 19, Ivanti published a new advisory to inform customers that a new vulnerability incidentally addressed with the September 10 patches, tracked as CVE-2024-8963, has also been exploited in attacks. 

“If CVE-2024-8963 is used in conjunction with CVE-2024-8190 an attacker can bypass admin authentication and execute arbitrary commands on the appliance,” Ivanti explained. “We are aware of a limited number of customers who have been exploited by this vulnerability.”  

SecurityWeek noted when Ivanti announced in-the-wild exploitation of CVE-2024-8190 that the flaw has likely been leveraged alongside another flaw, considering that its exploitation requires admin privileges.

CVE-2024-8963 has been described as a critical path traversal issue in the CSA product that allows a remote, unauthenticated attacker to access restricted functionality. 

CSA 4.6 Patch 519 and CSA 5.0 address the vulnerability. However, version 4.6 has reached end of life and this is the last update it will receive, therefore users should upgrade the product to version 5.0. 

CISA has added CVE-2024-8963 to its Known Exploited Vulnerabilities Catalog, instructing federal agencies to address it by October 10. 

There does not appear to be any public information on the attacks involving the exploitation of CVE-2024-8963 and CVE-2024-8190.

It’s not uncommon for threat actors to exploit Ivanti product vulnerabilities, including for backdoor delivery and to hack high-profile organizations such as MITRE and CISA.  

Related: MITRE Hack: China-Linked Group Breached Systems in December 2023

Related: Governments Urge Organizations to Hunt for Ivanti VPN Attacks

Related: Chinese Cyberspies Use New Malware in Ivanti VPN Attacks