Most organizations would not have caught the Ivanti Connect Secure exploitation from the appliance alone, because CISA found that Ivanti's own integrity checker tool failed to detect compromise. Catching it took independent monitoring: knowing the device exists, logs sent off the box, restricted egress, and the ability to reset credentials fast.
This is a test of controls, not of people. The attackers used chained zero-day flaws in an internet-facing security product. Capable teams were affected.
What happened, in short?
Per CISA's advisory AA24-060B, published 29 February 2024 with the FBI, MS-ISAC and partners in Australia, the UK, Canada and New Zealand, actors exploited vulnerabilities in Ivanti Connect Secure and Policy Secure gateways: CVE-2023-46805, CVE-2024-21887 and CVE-2024-21893. Chained, they allowed bypassing authentication and running commands with elevated privileges.
Volexity first identified exploitation in early December 2023 and reported on 10 January 2024. Ivanti provided mitigation guidance in January, and CISA says the actors found a way around those mitigations. Ivanti then disclosed further flaws, including CVE-2024-22024 and CVE-2024-21888. CISA issued Emergency Directive 24-01 on 19 January 2024 for federal civilian agencies and later issued supplemental directions.
In incidents CISA handled, actors implanted web shells, harvested credentials stored on the devices, and moved into domain environments. The advisory says CISA's own lab research showed an attacker might keep root-level persistence through factory resets and upgrades.
The ten-question checklist
Score one point per honest yes.
1. Do you have a live inventory of every internet-facing appliance? VPNs, gateways and firewalls are easy to forget because they are not servers. If you cannot list them in five minutes, you cannot patch them.
2. Do you learn about exploited vulnerabilities in those products the same day? CISA recommends prioritizing known exploited flaws in internet-facing systems and patching within 24 to 48 hours of disclosure. Check that someone owns the feed.
3. Can you apply a vendor mitigation, and also verify it worked? The actors bypassed the first mitigations. A mitigation you cannot test is a hope.
4. Do the appliance's logs leave the box in real time? If an attacker controls the device, logs kept only on it are suspect. Send them to a collector you control.
5. Do you monitor with something other than the vendor's own integrity tool? CISA's finding was blunt: the internal and external tools were not reliable, because web shells were found on systems with no file mismatches. Add network detections and endpoint telemetry on the hosts around the appliance.
6. Is outbound traffic from the appliance restricted to what it needs? CISA lists this as a mitigation, since it limits tool downloads and command-and-control connections.
7. Is the appliance's directory bind account low privilege, and are VPN sessions limited to unprivileged accounts? The advisory warns that domain administrator credentials can be exported when an appliance holds privileged access.
8. Can you rotate every credential the appliance touched, quickly? CISA's guidance is to assume credentials stored on affected appliances are likely compromised. Test your list: user accounts, service accounts, certificates, API keys.
9. Do you have a plan to rebuild from trusted media? CISA says a device whose validation tooling can be modified by its own software has no root of trust short of returning it to the manufacturer. Know the vendor's restore path before you need it.
10. Do you ask suppliers for an SBOM, a disclosure policy and an end-of-life policy? CISA lists these as criteria for choosing a VPN vendor.
How to read your score
In our rough reading, eight or more means your controls are in decent shape for this class of event. Five to seven: fix questions 4, 5 and 8 first, since they decide how fast you detect and recover. Under five: treat edge devices as a project, not a backlog item.
Software supply chain tooling helps with questions 1, 2 and 10 but not with the appliance firmware itself. An SBOM from your own products and a scan of your dependencies tell you about your code. An appliance is vendor-managed software you can only protect by inventory, isolation and monitoring.
What to do
- Build the appliance inventory and give each device a named owner.
- Subscribe to CISA's Known Exploited Vulnerabilities catalog and your vendors' advisories.
- Forward appliance logs to a collector off the device.
- Restrict appliance egress to required destinations.
- Move VPN and bind accounts to least privilege.
- Write and rehearse a credential rotation runbook for appliance-connected accounts.
- Document the vendor's rebuild process and keep trusted media.
- Send suppliers the SBOM, disclosure and end-of-life questions.
Quick check
Would a clean integrity check have proven the appliance was safe?
No. CISA found the vendor's integrity checker failed to detect compromise in real incidents and recommended assuming sophisticated actors can persist even after a factory reset.
What did CISA tell network defenders to assume?
That user and service account credentials stored on affected appliances are likely compromised, and to hunt for malicious activity using the advisory's indicators.
Sources
- CISA AA24-060B: Threat Actors Exploit Multiple Vulnerabilities in Ivanti Connect Secure and Policy Secure Gateways
- CISA Emergency Directive 24-01
- CISA Known Exploited Vulnerabilities catalog
Last reviewed: 18 October 2026.
