Authentication Bypass Vulnerability in Ivanti Virtual Traffic Manager

What changed

A critical vulnerability has been discovered in the Ivanti Virtual Traffic Manager (vTM) that allows remote unauthenticated attackers to bypass the authentication mechanism of the admin panel. This flaw arises from an incorrect implementation of the authentication algorithm in versions of the software prior to 22.2R1 and 22.7R2.

Who is affected

Organizations using Ivanti Virtual Traffic Manager versions earlier than 22.2R1 or 22.7R2 are at risk. This vulnerability could lead to unauthorized access to sensitive administrative functions within the application.

• Ivanti Virtual Traffic Manager users
• IT departments managing Ivanti products
• Organizations relying on Ivanti for traffic management solutions

What to do

It is crucial for affected organizations to review their current version of Ivanti Virtual Traffic Manager and apply any available updates to mitigate this vulnerability. Implementing additional security measures, such as network segmentation and access controls, can also help protect against unauthorized access.

• Upgrade to Ivanti vTM version 22.2R1 or 22.7R2 or later
• Monitor for any suspicious activity on affected systems
• Review and enhance security protocols related to admin access