Ivanti has issued urgent patches for two (2) critical vulnerabilities in its Standalone Sentry and Neurons for IT Service Management (ITSM) solution. The Standalone Sentry vulnerability, tracked as CVE-2023-41724, allows unauthenticated attackers to conduct remote code execution (RCE) on the appliance’s operating system from within the same network, affecting all supported versions. This flaw, reported by NATO Cyber Security Centre researchers, is significant due to Standalone Sentry’s role as a Kerberos Key Distribution Center Proxy (KKDCP) or a gatekeeper for ActiveSync-enabled servers. The second vulnerability, tracked as CVE-2023-46808, impacts Neurons for ITSM, enabling attackers with low-level access to execute commands in the context of the web application’s user, with cloud landscapes already secured but leaving on-premises deployments exposed. Ivanti has not found evidence indicating that these vulnerabilities are being actively exploited in the wild but urges immediate action to prevent potential exploitation. The advisories are set against a number of Ivanti vulnerabilities that have been previously exploited by nation-state actors and threat groups, leading to widespread attacks and emergency directives from cybersecurity agencies to secure Ivanti Connect Secure and Policy Secure systems against zero-day flaws. These incidents highlight the critical importance of maintaining security hygiene and the potential consequences of unaddressed vulnerabilities in widely used enterprise software. CTIX analysts recommend that all administrators utilizing the affected Ivanti solutions patch their software as soon as possible to prevent potential exploitation.