Two (2) zero-day vulnerabilities impacting Ivanti Connect Secure (ICS) and Policy Secure (IPS) have been exploited as an attack chain to conduct remote code execution (RCE) by threat actors suspected to be affiliated with China. ICS is remote access VPN software/hardware, and IPS is a network access control (NAC) solution which only provides network access to authorized users and devices. The first flaw, tracked as CVE-2023-46805, is an authentication bypass vulnerability allowing remote unauthorized access to restricted resources. The second flaw, tracked as CVE-2023-21887 is a command injection vulnerability allowing authenticated administrator users to execute arbitrary commands. The vulnerabilities can be combined to gain unauthenticated command execution and full control over vulnerable instances of ICS and IPS over the internet, enabling attackers to craft malicious requests and execute commands without authentication. According to researchers, the observed attackers attempted to tamper with Ivanti’s system monitoring tool to “steal configuration data, modify existing files, download remote files, and reverse tunnel from the ICS VPN appliance.” This is a highly-sophisticated compromise, and the threat actors were observed conducting reconnaissance, moving laterally across the network, and the deploying a custom web shell named GLASSTOKEN for persistent access. Researchers have attributed this compromise to a threat actor tracked as UTA0178 and stated that the VPN appliances may have been compromised since December 3, 2023. At this time, the implemented patches are not sufficient to prevent exploitation, and Ivanti has provided mitigations in the interim to help harden their customers’ defensive posture while Ivanti releases staggered patches throughout January 2024. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added the vulnerabilities to their Known Exploited Vulnerabilities (KEV) catalog mandating federal agencies to apply the patches by no later than January 31, 2024. CTIX analysts recommend that any administrators or security personnel responsible for maintaining instances of ICS/IPS, investigate their network for any evidence of exploitation, and apply the mitigation protocols immediately to prevent future exploitation.