ZDI Drops 13 Unpatched Ivanti Endpoint Manager Vulnerabilities

AI-suggested

European organizations should immediately implement strict access controls to limit interaction with Ivanti Endpoint Manager components, especially the AgentPortal service and affected classes. Network segmentation should isolate management servers to reduce exposure. Enforce strong authentication mechanisms, including multi-factor authentication, to mitigate risks from compromised credentials. Monitor logs and network traffic for unusual activity related to Ivanti services. Employ application whitelisting and endpoint detection and response (EDR) solutions to detect and block exploitation attempts. Educate users about phishing and social engineering risks, particularly regarding opening suspicious files or links. Temporarily disable or restrict features that process user-supplied input if feasible. Maintain up-to-date backups and incident response plans tailored to potential endpoint compromise scenarios. Engage with Ivanti support for updates and prioritize patch deployment once available. Consider deploying virtual patching or compensating controls via web application firewalls or intrusion prevention systems to mitigate exploitation risks during the patch delay.