Read more: informationsecuritybuzz.com
A critical vulnerability, CVE-2024-8963, affecting Ivanti’s Cloud Services Appliance (CSA) is under active exploitation by threat actors. This path traversal flaw allows remote attackers to bypass administrative controls and access restricted functionality, potentially leading to unauthorized access and arbitrary command execution. This vulnerability is chainable with a previously disclosed command injection vulnerability, CVE-2024-8190, which also allows attackers to bypass authentication and execute commands on the appliance, emphasizing the urgency of patching.