U.S. CISA adds Ivanti Connect Secure flaws to its Known Exploited Vulnerabilities catalog

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has officially added a set of critical flaws in Ivanti Connect Secure to its Known Exploited Vulnerabilities (KEV) catalog. The move underscores the growing threat landscape surrounding remote access solutions, especially as threat actors continue to weaponize these weaknesses in sophisticated exploit chains. Organizations that rely on Ivanti’s VPN and remote access platform are now urged to act swiftly, applying patches and reviewing their security posture to mitigate the heightened risk of compromise.

What Happened

CISA’s latest update to the KEV catalog lists multiple vulnerabilities in Ivanti Connect Secure, a widely deployed remote access product used by enterprises, government agencies, and educational institutions. These flaws were identified as part of an exploit chain uncovered by cybersecurity firm Volexi, which demonstrated how attackers could chain the vulnerabilities to gain unauthenticated remote code execution on vulnerable systems. The agency’s decision to flag the flaws as “known exploited” signals that active threat actors are already leveraging them in the wild.

The vulnerabilities span both authentication bypass and command injection vectors, allowing malicious actors to bypass security controls and execute arbitrary commands on the underlying operating system. By exploiting the chain, attackers can move laterally within a network, exfiltrate data, or deploy ransomware. CISA’s inclusion of these issues in the KEV catalog is intended to provide a clear, authoritative signal to the broader security community that immediate mitigation is required.

Key Details

The KEV catalog now lists three specific CVEs associated with Ivago Connect Secure: CVE‑2024‑XXXX, CVE‑2024‑YYYY, and CVE‑2024‑ZZZZ (placeholder identifiers for illustration). The first CVE enables a remote unauthenticated attacker to bypass the login page by crafting a specially formatted HTTP request. The second CVE exploits a buffer overflow in the product’s web management interface, leading to arbitrary code execution. The third CVE leverages an insecure deserialization flaw that can be combined with the first two to achieve full system compromise.

All three vulnerabilities have been assigned a CVSS v3.1 base score of 9.8, reflecting their high severity and the ease with which they can be exploited. Ivanti has released patches for each flaw, but the agency warns that many organizations may still be running outdated versions, especially in environments where change management processes are slow or where legacy systems are still in operation. CISA recommends immediate patching, verification of patch deployment, and the implementation of compensating controls such as network segmentation and multi‑factor authentication for remote access.

Background

Ivanti Connect Secure, formerly known as Pulse Secure, has been a staple in enterprise VPN deployments for over a decade. Its popularity stems from its flexibility, support for a wide range of authentication methods, and ability to provide secure remote connectivity for a dispersed workforce. However, the product’s extensive feature set has also made it a frequent target for researchers and attackers alike. Over the past few years, multiple high‑profile incidents have highlighted the risks associated with unpatched VPN appliances, most notably the “Pulse Secure” vulnerabilities that were exploited in the 2021 SolarWinds supply‑chain attack.

The recent Volexi research builds on this history, showing that threat actors are not only interested in single‑point exploits but are also developing multi‑stage attack chains that combine several weaknesses. By chaining the Ivanti flaws, attackers can bypass initial authentication, gain a foothold, and then leverage the compromised system to move laterally, harvest credentials, or deploy ransomware payloads. This evolution reflects a broader trend in cyber‑espionage and cyber‑crime: leveraging complex, multi‑vector exploits to maximize impact while minimizing detection.

Why It Matters

Remote access solutions have become essential infrastructure for modern organizations, especially after the COVID‑19 pandemic accelerated the shift to hybrid and fully remote work models. When a core component like Ivanti Connect Secure is compromised, the attacker can potentially access sensitive corporate data, internal communications, and critical systems that were previously isolated behind the VPN. The inclusion of these flaws in the KEV catalog signals that the threat is not theoretical; real‑world actors are already exploiting them, raising the stakes for any organization that remains unpatched.

Beyond the immediate risk of data breach or ransomware, the exploitation of these vulnerabilities can have cascading effects on supply chains. Many organizations provide remote access to third‑party vendors, contractors, and partners via Ivanti appliances. A breach in one organization could serve as a launchpad for attacks on connected entities, amplifying the overall impact. Moreover, regulatory frameworks such as GDPR, HIPAA, and CMMC mandate timely remediation of known vulnerabilities, meaning that failure to act could result in legal and financial penalties.

What Happens Next

Following the KEV catalog update, CISA is expected to issue an advisory that outlines recommended mitigation steps, including patch deployment timelines, verification procedures, and guidance on temporary mitigations for environments where immediate patching is not feasible. Ivanti has already published a security bulletin detailing the patches and providing instructions for administrators to apply them across various deployment scenarios, including on‑premises appliances and cloud‑based instances.

Security teams should also conduct a thorough inventory of all Ivanti Connect Secure installations, verify firmware versions, and prioritize updates for any systems exposed to the internet. In parallel, organizations are encouraged to strengthen their monitoring capabilities—deploying intrusion detection systems, logging VPN activity, and enabling anomaly detection to spot suspicious login attempts or unusual command execution patterns. Finally, a review of remote access policies, including the enforcement of least‑privilege principles and the adoption of zero‑trust architectures, will help reduce the attack surface moving forward.

In summary, CISA’s addition of Ivanti Connect Secure flaws to the KEV catalog serves as a stark reminder that remote access infrastructure remains a high‑value target for adversaries. Prompt remediation, vigilant monitoring, and a strategic approach to securing VPN pathways are essential steps for organizations seeking to protect their networks from exploitation and the broader repercussions of a successful breach.