Summary
- CISA has added a new Ivanti vulnerability to its Known Exploited Vulnerabilities catalogue — the sixth Ivanti flaw confirmed exploited in 2025.
- Microsoft’s latest Patch Tuesday addressed more than 1,400 vulnerabilities, described as a record for a single monthly release.
- A severe Microsoft vulnerability was among the patches issued, drawing particular attention from researchers.
- Federal agencies in the United States are subject to mandatory remediation timelines under CISA’s KEV directive.
- The volume and pace of disclosures this month places significant pressure on patch management programmes.
Another Ivanti flaw under active attack
CISA has added a newly identified Ivanti vulnerability to its Known Exploited Vulnerabilities catalogue, confirming that threat actors are actively taking advantage of the flaw. This marks the sixth Ivanti vulnerability to reach that threshold in 2025 alone, a frequency that reflects sustained adversary interest in Ivanti products and raises legitimate questions about the risk profile of organisations that rely on them.
A pattern that warrants strategic attention
Six confirmed exploitations across a single vendor’s product line within one calendar year is not routine noise. It indicates that Ivanti’s products remain a productive target — whether because of their network-edge positioning, their prevalence in enterprise environments, or the underlying complexity of securing them. Security leaders who have not already re-examined their exposure to Ivanti deployments should treat this latest advisory as a prompt to do so.
Researchers and federal authorities both take notice
The new Ivanti flaw drew scrutiny from both security researchers and United States federal authorities, according to The Record. The convergence of government and independent research attention typically signals that a vulnerability is being observed across multiple threat actor clusters, not just a single incident. The sources do not specify which threat actors have been attributed to exploitation, and the specific technical details of the vulnerability were not outlined in the available material.
Microsoft Patch Tuesday sets a volume record
Microsoft’s June Patch Tuesday release addressed more than 1,400 vulnerabilities, which The Record describes as a record for a single monthly update cycle. Among those patches is at least one severe Microsoft vulnerability that researchers have highlighted as particularly significant. The sheer volume of this release creates a prioritisation challenge for security operations and patch management teams, who must triage an unusually large queue while also responding to the active Ivanti threat.
Severity within the volume
A Patch Tuesday release exceeding 1,400 CVEs is a material operational event. Even if the majority of those vulnerabilities carry moderate or low severity ratings, the presence of a severe flaw within such a large batch means patch teams cannot rely on standard triage timelines. The specific details of the severe Microsoft vulnerability — including its CVE identifier, affected product, and exploitation status — were not detailed in the source material available to this publication.
Compliance obligations for government and critical infrastructure
For organisations subject to CISA’s Binding Operational Directive 22-01, the new Ivanti listing carries a mandatory remediation deadline. Federal civilian executive branch agencies in the United States are required to address KEV-listed vulnerabilities within defined timeframes. Organisations outside that scope who nonetheless look to the KEV catalogue as a prioritisation guide — a reasonable practice — should treat the Ivanti entry as high priority given the confirmed exploitation activity.
Why it matters
CISOs are managing two distinct but simultaneous pressures this cycle. The sixth Ivanti exploitation of the year is not an isolated incident — it is part of a sustained campaign against a vendor whose products sit at sensitive points in enterprise networks, including remote access and network management infrastructure. At the same time, a record-volume Microsoft Patch Tuesday with at least one severe vulnerability means that patch management capacity is being stretched at precisely the wrong moment. The practical risk is that teams deprioritise one threat while addressing the other. Both require a structured response, and the volume of the Microsoft release should not be used as justification for delaying action on the Ivanti KEV listing.
What to do now
- Review all Ivanti product deployments in your environment and confirm whether the newly listed vulnerability applies to your versions.
- Apply available Ivanti patches or mitigations in accordance with CISA KEV timelines, or faster if your organisation’s risk tolerance demands it.
- Triage the Microsoft Patch Tuesday release of more than 1,400 CVEs, prioritising the severe vulnerability identified by researchers.
- Review CISA’s Known Exploited Vulnerabilities catalogue directly for the specific CVE identifier and remediation guidance for the new Ivanti flaw.
- Assess whether existing patch management workflows can absorb a record-volume release without deprioritising critical items, and adjust resource allocation accordingly.
