The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has flagged a critical vulnerability in Ivanti’s Virtual Traffic Manager (vTM) as under active exploitation and added it to its Known Exploited Vulnerabilities (KEV) catalog. This flaw, tracked as CVE-2024-7593, has a CVSS score of 9.8/10, and is due to an incorrect implementation of the authentication algorithm, allowing remote attackers to bypass authentication on Internet-exposed vTM admin panels and create rogue administrator accounts. Although Ivanti released patches in March and May 2024 to address this vulnerability, the company has confirmed that proof-of-concept (PoC) exploit code is publicly available. While Ivanti is unaware of active exploitation at the time of disclosure, it urges users to update their systems and restrict access to the management interface by binding it to private networks or trusted IPs. CISA has mandated that Federal Civilian Executive Branch (FCEB) agencies patch the vulnerability by no later than October 15, 2024, in accordance with Binding Operational Directive (BOD) 22-01, while private organizations worldwide are strongly advised to prioritize securing their systems against this flaw. Ivanti has been working on enhancing its internal security measures and disclosure processes following repeated attacks on its product lines in recent months. CTIX analysts urge any administrators impacted by this flaw to ensure that their systems are as hardened as possible to prevent exploitation.