Ivanti has told customers to patch an actively exploited zero-day flaw in its Connect Secure (ICS) remote access gateway, warning that the vulnerability is already being used in real-world attacks against internet-facing deployments.
The warning, first reported by BleepingComputer, is the latest entry in a familiar pattern: critical flaws in enterprise VPN and perimeter appliances, exploited by attackers at unusual speed. Ivanti's advisory sets out the affected product versions and the remediation path, and customers are being urged to apply the fix immediately rather than wait for a routine maintenance window.
Why this matters
Connect Secure appliances sit at the network edge, by design. That makes them a high-value target: successful exploitation hands an attacker a remote access foothold and, potentially, a route into internal networks and identity infrastructure — before any endpoint controls or internal segmentation come into play.
Perimeter access products from a handful of vendors — Ivanti among them, alongside Fortinet, Palo Alto Networks and Citrix — have been a persistent hunting ground for both financially motivated groups and intrusion sets with espionage objectives in recent years. For organisations that treat the VPN appliance as "just infrastructure," the recurring lesson is that these devices deserve the same patching urgency as internet-facing web servers.
What security teams should do now
Defenders running Ivanti Connect Secure should prioritise four actions:
- Confirm exposure. Identify every ICS instance facing the internet, including devices managed by third parties or acquired through mergers. Shadow deployments are the ones that get missed.
- Patch against the advisory. Apply the vendor-supplied fix, or where an immediate patch is not feasible, implement any interim mitigations Ivanti has published in the advisory until the update can be applied.
- Hunt for persistence. Do not assume that applying the fix evicts an attacker who has already been inside. Review logs, look for anomalous authentication events, unexpected configuration changes and unrecognised accounts or certificates, and scan known indicators of compromise (IoCs) published alongside the advisory.
- Revisit factory-reset assumptions. Where compromise is suspected, note that some intrusion techniques against VPN appliances have been documented as surviving a straightforward factory reset of the device — meaning remediation may require rebuilding from a known-good image and rotating every credential and certificate touched by the appliance, not simply restoring defaults.
Organisations should also treat any account that authenticated through the affected gateway during the exposure window as potentially compromised until proven otherwise.
Relevance for Hong Kong enterprises
As a general observation rather than a claim about any specific incident: Ivanti Connect Secure and comparable remote-access gateways are common in Hong Kong's financial, professional services and public-sector environments, where distributed workforces and cross-border access make VPN infrastructure operationally central. That ubiquity is precisely what makes an edge zero-day a sector-wide concern rather than a single-vendor issue.
Two practical realities are worth factoring into any response plan. First, emergency patching on production network infrastructure often passes through change-approval and regression-testing cycles that can add days to a fix that attackers can weaponise in hours; organisations that want to act within hours need pre-agreed emergency change paths for exactly this scenario. Second, a meaningful share of deployments are maintained by managed-service providers or outsourced network teams, so the countdown starts at the moment the vendor's advisory is published — regardless of whether the in-house security team has visibility of the appliance.
Third-party exposure deserves the same attention: an ICS instance run by a supplier or partner on your behalf is still your attack surface, and should be inventoried and tracked accordingly.
Ivanti's advisory contains the authoritative CVE identifiers, affected build numbers and mitigation guidance, and should be the reference point for remediation decisions rather than secondary reporting.
Ivanti 已要求客戶為其 Connect Secure（ICS）遠端存取閘道中一個正在被實際利用的零日漏洞進行修補，並警告該漏洞已遭用於針對互聯網對外部署的真實攻擊。
有關警告由 BleepingComputer 首先報道，是屢見不鮮的模式的最新一例：企業 VPN 及邊界防護裝置上的嚴重漏洞，以異常迅速的速度被攻擊者利用。Ivanti 的安全通告已列明受影響的產品版本及補救途徑，並敦促客戶立即套用修補程式，而非等待例行維護時段。
為何此事重要
Connect Secure 裝置按設計部署於網絡邊界，這使其成為高價值目標：攻擊者一旦成功利用，即可取得遠端存取立足點，並有可能打開通往內部網絡及身份基礎設施的路徑——一切發生在任何端點防禦或內部網絡分段介入之前。
近年來，包括 Ivanti 在內（與 Fortinet、Palo Alto Networks 及 Citrix 並列）的少數供應商所提供的邊界存取產品，一直是財務動機型團伙及具諜報目標的入侵組織的長期狩獵場。對於將 VPN 裝置視為「只不過是基礎設施」的機構而言，反覆出現的教訓是：這些裝置應獲得與互聯網對外 Web 伺服器同等的修補緊急程度。
安全團隊現階段應採取的行動
運行 Ivanti Connect Secure 的防禦方應優先執行四項行動：
- 確認暴露範圍。 識別所有面向互聯網的 ICS 實例，包括由第三方管理或透過併購取得的設備。影子部署（shadow deployments）往往就是被遺漏的部分。
- 依據通告進行修補。 套用供應商提供的修補程式；若無法即時修補，則須實施 Ivanti 在通告中公布的任何臨時緩解措施，直至更新可以套用。
- 搜尋持久化跡象。 不要假設套用修補程式便能將已潛入的攻擊者驅逐。應檢視日誌，尋找異常認證事件、非預期的配置變更、無法識別的帳戶或證書，並掃描與通告同時公布的已知入侵指標（IoCs）。
- 重新評估恢復原廠設定的假設。 若懷疑已遭入侵，須留意已有文獻記載部分針對 VPN 裝置的入侵手法能在設備直接恢復原廠設定後依然存活——這意味著補救措施可能需要從已知可信的映像重建，並輪換該裝置接觸過的每一項憑證及證書，而非僅僅還原預設值。
機構亦應將在暴露期間透過受影響閘道進行認證的任何帳戶視為可能已遭入侵，除非能夠證明並非如此。
對香港企業的意義
以下為一般性觀察，並非針對任何特定事故的聲明：Ivanti Connect Secure 及同類遠端存取閘道在香港的金融、專業服務及公共部門環境中相當普遍，這些環境的分散式工作人員及跨境存取使 VPN 基礎設施在運作上處於核心地位。正是這種無處不在，令邊界零日漏洞成為整個行業的關注議題，而非單一供應商的問題。
有兩項實際情況值得納入任何應變計劃。第一，生產網絡基礎設施上的緊急修補通常須經過變更審批及回歸測試流程，可能令一個攻擊者數小時內便可武器化的漏洞，修補時間拖延數天；希望在數小時內行動的機構，必須為此類場景預先設立緊急變更途徑。第二，相當一部分部署由託管服務供應商或外判網絡團隊維護，因此倒數由供應商通告發布一刻便已開始——無論內部安全團隊是否能掌握該裝置的可見度。
第三方暴露同樣值得重視：由供應商或合作夥伴代為運行的 ICS 實例仍然是你的攻擊面，應相應地進行登記及追蹤。
Ivanti 的通告載有權威的 CVE 編號、受影響的版本號及緩解指引，應作為補救決策的參考依據，而非二手報道。