According to the reporting, the flaw affects Ivanti Connect Secure deployments, and the exploitation activity has been ongoing for an extended period, making prompt patching critical for organizations relying on the product for remote access.

Administrators should take the following steps:

• Apply the available fix for the affected Ivanti Connect Secure flaw as soon as possible.
• Prioritize internet-facing ICS appliances, since these are the likely targets of the ongoing exploitation.
• Monitor for signs of compromise tied to the vulnerability, especially on systems that may have been exposed since early October.
• Review vendor guidance and CISA advisories for any additional detection or mitigation details.

Given that exploitation has reportedly been underway since at least October 1st, any organization running Ivanti Connect Secure should treat this as urgent rather than routine patching.

Source: BleepingComputer

Has your organization already applied the Ivanti Connect Secure patch, or are you still working through the remediation process?