CISA Places Ivanti Connect Secure Flaws on KEV List After Confirmed Wild Exploits

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) officially listed two newly disclosed Ivanti Connect Secure (ICS) vulnerabilities in its Known Exploited Vulnerabilities (KEV) catalog on Friday, citing evidence that malicious actors are already leveraging the flaws to gain unauthenticated root access on vulnerable systems.

Security researchers have identified a chain of three separate weaknesses in the latest versions of the VPN‑style gateway. When combined, the defects enable an attacker without any credentials to execute arbitrary code at the highest privilege level on the underlying server. The chain includes a deserialization issue, an insecure default configuration, and a privilege‑escalation bug that together bypass authentication checks.

Ivanti Connect Secure is widely deployed in corporate networks, remote‑work environments, and government agencies as a gateway for secure remote access. Its popularity stems from a reputation for ease of deployment and integration with existing identity solutions, making it a common target for threat groups seeking to infiltrate internal networks.

Since the vulnerabilities were publicly disclosed, multiple intrusion‑detection logs and threat‑intel feeds have reported active exploitation. Analysts observed attempts to probe public IP addresses for the vulnerable service, followed by rapid exploitation that resulted in full system compromise. While specific actor attribution remains unconfirmed, the tactics align with known patterns of financially motivated cybercrime groups that specialize in ransomware deployment.

Ivanti responded to the disclosures by releasing patches that address each of the three flaws and issued guidance urging customers to apply the updates immediately. The vendor also recommended temporary mitigations such as disabling unnecessary services, restricting inbound traffic to trusted sources, and monitoring logs for anomalous authentication attempts until patches can be deployed.

The inclusion of the flaws in CISA’s KEV list underscores the agency’s effort to highlight vulnerabilities that pose an immediate risk to critical infrastructure. Organizations that rely on Ivanti Connect Secure are advised to verify patch status, review configuration settings, and consider additional network segmentation to limit potential lateral movement. As the KEV catalog continues to evolve, security teams are encouraged to monitor CISA updates closely, as they often signal emerging attack trends that warrant swift remediation.