LUCAMEThe US cybersecurity agency CISA has confirmed that two vulnerabilities in Ivanti Connect Secure are being actively exploited in the wild. One flaw lets attackers bypass authentication entirely on critical functions, and the other relates to predictable session identifiers that can be guessed or manipulated. Both are now on CISA's list of known exploited vulnerabilities, meaning real attacks are happening, not just theoretical ones.
What this means for your business
If your organisation uses Ivanti Connect Secure for remote access or VPN, you need to patch it now. These aren't low-priority issues: an unauthenticated attacker could potentially get into your network without needing a password. Check with your IT team or us that you're running the latest patched version, and if you're unsure whether Ivanti is in your environment, it's worth finding out quickly.