CISA’s urgent fix: Ivanti VPN holes Patch now, federal agencies

The Cybersecurity and Infrastructure Security Agency (CISA) has issued an emergency directive ordering federal agencies to patch vulnerabilities in Ivanti VPN software that are being actively exploited. The directive applies to a series of vulnerabilities publicly disclosed by Ivanti on 10 January. Some 2,100 devices worldwide have already been affected. The attacks appear to be largely opportunistic, and CISA has yet to attribute any actor to the campaign. It has now warned US federal agencies of “widespread and active exploitation” and urged them to meet a deadline on Tuesday for patching their systems.