Extra Bytes, Information Security

CISA’s Emergency Response to Ivanti VPN Security Flaws

Targeted attacks on a diverse range of sectors.

Kelsey Brandt

Contributing Writer

The Cybersecurity and Infrastructure Security Agency (CISA) has issued a critical emergency directive in response to severe vulnerabilities discovered in Ivanti Connect Secure and Ivanti Policy Secure products. This urgent directive, aimed at all Federal Civilian Executive Branch (FCEB) agencies, calls for immediate action to mitigate the risks posed by two zero-day flaws, CVE-2023-46805 and CVE-2024-21887.

These vulnerabilities have been exploited in widespread and active attacks by multiple threat actors, including a suspected Chinese state-backed group. The directive outlines specific actions that federal agencies must undertake to mitigate the risks associated with these vulnerabilities.

Why it matters: The directive reflects the severity and urgency of the threat posed by these vulnerabilities, which enable attackers to execute arbitrary commands, move laterally within networks, exfiltrate data, and establish persistent system access. The wide range of affected organizations, including government and military departments, telecom companies, and financial institutions, underscores the potential for significant national security and economic impacts.

CISA’s directive, Emergency Directive ED 24-01, requires federal agencies to implement Ivanti’s publicly disclosed mitigation measures, report compromises, and remove compromised products from networks. Agencies must also reset passwords, revoke certificates, and apply updates within 48 hours of their release.

Ivanti has provided temporary mitigations and is expected to release comprehensive fixes. Agencies must follow specific recovery instructions, including revoking and reissuing certificates and resetting passwords.

Attackers have been observed deploying cryptocurrency miners and various malware strains. The attacks have targeted a diverse range of sectors, highlighting the broad impact of these vulnerabilities.