A missing authorization flaw in multiple Ivanti products permits authenticated attackers with limited administrative rights to perform unauthorized configuration changes, posing a significant risk to system integrity.

This vulnerability, classified as CWE-862, stems from a failure to properly validate authorization levels for administrative functions. It allows an attacker who already possesses read-only admin privileges to bypass restrictions and alter sensitive system configurations.

The ability for a read-only administrator to modify system settings threatens the overall security posture and operational integrity of the affected network infrastructure. With a CVSS score of 7.6, this vulnerability represents a high risk, as it could be leveraged to escalate privileges or prepare the environment for further exploitation. Successful compromise may lead to unauthorized access, potential service disruption, or the manipulation of security policies.

Immediate Action: Administrators must update their respective Ivanti software to the versions specified in the vendor security advisory to remediate this authorization flaw.

Proactive Monitoring: Review administrative audit logs for any unexpected configuration changes or modifications initiated by accounts with read-only permissions.

Compensating Controls: Implement strict role-based access control (RBAC) to limit the number of users with administrative access until patches can be applied, and ensure management interfaces are not exposed to the public internet.

Public Exploit Available: No

Given the critical nature of the affected products as security gateways and policy enforcement points, the potential for unauthorized configuration changes must be addressed immediately. Organizations should prioritize the deployment of the provided patches to ensure that read-only administrators cannot perform unauthorized actions, thereby maintaining the integrity of the security infrastructure.