CISA Flags Ivanti Connect Secure Flaws as Actively Exploited, Urges Immediate Mitigation

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has officially listed multiple vulnerabilities in Ivanti Connect Secure as part of its Known Exploited Vulnerabilities (KEV) catalog, signaling that threat actors are already leveraging these weaknesses in the wild.

The addition follows CISA's routine monitoring of publicly disclosed security flaws and its assessment of real‑world exploitation activity. By placing the Ivanti Connect Secure issues on the KEV list, the agency is urging federal agencies, state and local governments, and private sector entities that rely on the remote‑access solution to prioritize remediation.

Ivanti Connect Secure, formerly known as Pulse Secure, provides VPN and secure gateway services that enable remote workers and branch offices to connect to corporate networks. The product is widely deployed across a range of industries, including healthcare, finance, and government, making any compromise potentially high‑impact. While the specific CVE identifiers were not disclosed in the brief, the agency’s notice indicates that attackers have developed reliable exploits that can bypass authentication or execute arbitrary code on vulnerable systems.

CISA’s KEV catalog serves as a curated list of the most pressing threats, and inclusion often prompts accelerated patch cycles. Organizations running Ivanti Connect Secure are advised to verify their software versions against the vendor’s advisories, apply any available updates, and consider temporary mitigations such as network segmentation or restricting inbound traffic until patches are deployed. The agency also recommends employing multi‑factor authentication and monitoring for anomalous login attempts.

Security researchers have long warned that remote‑access tools are attractive targets for cybercriminals, especially as remote work remains prevalent. The recent inclusion of Ivanti Connect Secure flaws underscores the broader challenge of keeping legacy VPN appliances up to date amid a rapidly evolving threat landscape. Experts note that many compromises stem from unpatched systems that remain exposed to the internet, highlighting the importance of proactive vulnerability management.

Looking ahead, CISA plans to continue publishing updates to the KEV catalog as new exploitation trends emerge. The agency’s collaboration with software vendors, industry groups, and international partners aims to accelerate the disclosure and remediation of critical bugs. For organizations that have not yet assessed their exposure to the Ivanti Connect Secure issues, the agency’s alert serves as a clear call to action: identify vulnerable assets, apply patches promptly, and bolster monitoring to detect potential intrusion attempts before damage occurs.