Ivanti security advisory January 2025
Ivanti has released three product updates resolving 20 CVEs. The affected products include Ivanti Avalanche, Ivanti Application Control Engine and Ivanti Endpoint Manager. Ivanti is not aware of any exploitation or public disclosures for the 20 resolved CVEs.
January 2025 update priorities:
- Microsoft Windows is the top priority this month, with three known exploited CVEs, two publicly disclosed vulnerabilities resolved and eight Critical CVEs.
- Microsoft Office is next in priority from a risk-based perspective. The update this month resolved three publicly disclosed CVEs in Access and two Critical CVEs in Excel. The two Excel CVEs could use the Preview Pane as an attack vector, making them ideal targets for threat actors.
- Ensure your browsers are all up to date. Mozilla released last week and Google Chrome and Microsoft Edge update weekly with security fixes.
Ivanti’s vulnerability management program is a central part of our commitment to security. We employ rigorous testing and validation methodologies to enable swift identification, patching, and disclosure of vulnerabilities in collaboration with the broader security ecosystem. Our priority is to provide responsible and transparent communication to our customers, so they are empowered to defend their environments.
In recent months, we have intensified our internal scanning, manual exploitation and testing capabilities, and have also made enhancements to our responsible disclosure process so that we promptly discover and address potential issues, and so that our customers are best equipped to take action.
As part of this, Ivanti releases standard security patches on the second Tuesday of every month. For many of our customers, the predictable schedule facilitates better planning and management of IT resources, allowing them to allocate time and personnel efficiently for the timely updates.
Today, fixes have been released for the Ivanti solutions detailed below. It is important for customers to know:
- We have no evidence of any of these vulnerabilities being exploited in the wild.
- These vulnerabilities do not impact any other Ivanti products.
More information on these vulnerabilities and detailed instructions on how to remediate the issues can be found in these Security Advisories:
- Ivanti Avalanche
- Ivanti Application Control Engine (AC Engine is present on Ivanti Application Control, Ivanti Neurons for App Control and can integrate with Ivanti Security Controls and Ivanti Endpoint Manager).
- Ivanti EPM
Our Support team is always available to help customers and partners should they have any questions.