Ivanti has released its December 2024 security updates, addressing critical vulnerabilities across its product lineup. These patches come as cybersecurity threats continue to evolve, making timely updates essential for enterprise security teams.

Overview of Ivanti's December 2024 Patches

Ivanti's latest security bulletin addresses 15 vulnerabilities across multiple products, including:
- Ivanti Connect Secure (ICS)
- Ivanti Policy Secure (IPS)
- Ivanti Neurons for ITSM
- Ivanti Endpoint Manager

Of these, three are rated Critical, seven as High, and five as Medium severity. The most severe vulnerabilities could allow remote code execution (RCE) or privilege escalation if left unpatched.

Critical Vulnerabilities Addressed

1. CVE-2024-32895 (CVSS 9.8)

  • Product: Ivanti Connect Secure
  • Impact: Unauthenticated RCE via buffer overflow
  • Fix: Patch ICS 22.5R1.3 or later

2. CVE-2024-32896 (CVSS 9.1)

  • Product: Ivanti Neurons for ITSM
  • Impact: SQL injection leading to admin access
  • Fix: Update to Neurons 2023.3.2

3. CVE-2024-32897 (CVSS 8.8)

  • Product: Ivanti Endpoint Manager
  • Impact: Privilege escalation via DLL hijacking
  • Fix: Apply EPMM 11.10.0.3
  1. Inventory Assessment: Identify all affected Ivanti products in your environment
  2. Patch Prioritization: Apply Critical updates within 24 hours, High within 72 hours
  3. Compromise Checks: Review systems for indicators of compromise (IOCs)
  4. Backup Configurations: Before applying updates
  5. Monitor Logs: For unusual authentication attempts

Ongoing Security Challenges

This marks Ivanti's fourth major patch release in 2024, reflecting:
- Increased scrutiny on enterprise security solutions
- Growing sophistication of supply chain attacks
- Expanded attack surfaces with hybrid work environments

Historical Context

These updates follow:
- January 2024's zero-day vulnerabilities (CVE-2024-21887)
- April 2024's authentication bypass issues
- September 2024's API security flaws

Expert Recommendations

Cybersecurity experts advise:
- Implementing virtual patching where immediate updates aren't possible
- Enabling multi-factor authentication (MFA) universally
- Conducting penetration tests post-patching
- Subscribing to Ivanti's security advisories

Looking Ahead

Ivanti has announced plans for:
- More frequent security bulletins in 2025
- Enhanced vulnerability disclosure program
- Integration with MITRE ATT&CK framework

Final Thoughts

While patching remains the immediate priority, organizations should view these updates as part of a broader security strategy encompassing threat detection, employee training, and layered defenses.