Ivanti Connect Secure 2024 exploitation: timeline and lessons

In January 2024, attackers chained two Ivanti Connect Secure and Policy Secure flaws, CVE-2023-46805 and CVE-2024-21887, weeks before a patch existed. CISA ordered federal agencies to disconnect affected appliances. The lesson for defenders is to treat VPN gateways as high-risk assets you can rebuild, monitor from outside, and replace quickly.

What happened, in order?

The dates below come from CISA's emergency directive page and joint advisory AA24-060B.

• Early December 2023: Volexity first observed active exploitation, according to CISA's advisory.
• 10 January 2024: Ivanti disclosed CVE-2023-46805 (an authentication bypass) and CVE-2024-21887 (command injection). Chained, they allow remote command execution. CISA's KEV catalog lists both with a 10 January 2024 added date.
• 19 January 2024: CISA issued Emergency Directive 24-01, requiring agencies to apply Ivanti's mitigation and run its integrity checker.
• 31 January 2024: A supplemental direction told agencies to disconnect all affected products by 2 February and to rebuild before returning them to service.
• 8 February 2024: Ivanti disclosed CVE-2024-22024 and released updates. CISA's second supplemental direction followed on 9 February.
• 29 February 2024: CISA and partners published AA24-060B, noting that Ivanti's integrity checker failed to detect compromise in their testing.

Later, CVE-2025-0282 (8 January 2025) and CVE-2025-22457 (4 April 2025) were also added to the KEV catalog for the same product family. As of the 16 October 2026 catalog feed, 36 entries list Ivanti as the vendor, across several products.

What did attackers do once inside?

CISA reports that actors dropped web shells, harvested credentials stored on the appliance, and moved sideways using tools already present on it, in some cases reaching full domain compromise. They also cleaned up after themselves by overwriting and time-stomping files. CISA's lab work showed an attacker could keep root-level persistence through factory resets and upgrades.

That last point is why the advice changed from "patch" to "rebuild, then reset every credential the device ever held."

Why did the usual playbook fail?

Three assumptions broke at once.

1. A patch would exist. For this window, only a mitigation file did, and attackers found ways around it.
2. The vendor's integrity tool would tell you if you were clean. CISA said a clean result is not proof of safety.
3. A factory reset removes an intruder. CISA's research showed it may not.

What to do

1. Inventory every internet-facing gateway. VPNs, firewalls and load balancers are the assets nobody lists until the advisory lands. ED 24-01 itself required an inventory within a week.
2. Subscribe to the KEV catalog and alert on any vendor you run. Treat an addition as a deadline, not a news item.
3. Forward gateway logs off the device. If the box is compromised, its own logs are suspect.
4. Limit outbound connections from SSL VPN appliances. CISA lists this as a mitigation.
5. Plan the rebuild before you need it. Know how to export configuration, rebuild from clean media, and reissue certificates and keys.
6. Assume stored credentials are lost. Reset service accounts and directory bind accounts, and use low-privilege accounts for directory lookups.
7. Weigh the risk of keeping the product. CISA's advisory asks owners to consider the significant risk of adversary persistence.

Where does supply chain tooling help?

Appliance firmware is software with its own dependency tree, and you rarely get an SBOM for it. What you can do is record which appliances and versions you run, match them against known exploited vulnerabilities, and prioritise by exploitation status rather than severity score alone. Safeguard's reachability analysis and compliance automation work on the software you build and run, and the same KEV-first habit applies to bought-in appliances.

Quick check

Sources

• CISA Emergency Directive 24-01
• CISA advisory AA24-060B
• CISA Known Exploited Vulnerabilities catalog and JSON feed (version 2026.10.16, fetched 18 October 2026)

Last reviewed: 18 October 2026.