On 10 January 2024 Ivanti disclosed two vulnerabilities in Connect Secure and Policy Secure. Nine days later the US Cybersecurity and Infrastructure Security Agency issued Emergency Directive 24-01, requiring federal civilian agencies to act immediately. This desk has read the directive.
CISA describes the two flaws in the plainest possible terms, and the description is the file.
When exploited in tandem, these vulnerabilities allow a malicious threat actor to execute arbitrary commands on a vulnerable product.
CISA Emergency Directive 24-01, January 2024
Neither Half Is The Story
CVE-2023-46805 is an authentication bypass in the web component: it lets a remote attacker reach restricted resources without credentials. On its own it gets you to pages you should not see.
CVE-2024-21887 is a command injection that, in CISA’s wording, "allows an authenticated administrator to send specially crafted requests and execute arbitrary commands". On its own it requires you to already be an administrator, which is a high bar.
Chain them and the bar disappears. The first flaw supplies the authentication the second one requires. This is the whole argument for treating a vulnerability chain as its own object rather than scoring each link: a pair of medium problems is not a medium problem.
The Product Category Is The Aggravating Factor
Connect Secure is a VPN gateway. It sits at the boundary by design, is reachable from the internet by definition, and holds the credentials of everyone who connects through it. It is also, as the corpus filed at 25-0109, sold as a security product.
CISA justified emergency action on "widespread exploitation of vulnerabilities by multiple threat actors, the prevalence of the affected products in the federal enterprise, the high potential for a compromise of agency information systems, the impact of a successful compromise, and the complexity of the proposed mitigations".
That last clause is the one that gets overlooked. The mitigation was complex — an XML file to import, then an integrity checker to run, then a rebuild if it found anything — which is why a directive was needed rather than a patch note.
Mitigation Is Not Eviction
The directive is explicit that applying the workaround does not undo an existing compromise: agencies were required to run Ivanti’s External Integrity Checker Tool as well, and to take further steps if it reported anything.
This distinction runs through the whole corpus. Closing the door is not the same as establishing that nobody is already inside, and an appliance that has been running attacker code cannot be trusted to report on itself. The desk filed the same problem at 24-0618, where a second intrusion arrived during recovery.
Built on CISA Emergency Directive 24-01, retrieved and read in full by this desk; quotations from it are verbatim. The CVE descriptions are CISA’s summaries of Ivanti’s advisory, quoted as such. Attribution of the exploitation to any particular group is deliberately absent: the directive cites "multiple threat actors" without naming them, research attributions to a China-linked cluster exist but this desk has not independently assessed them, and the analysis here does not depend on who was exploiting the chain. No figure for the number of compromised appliances is asserted. Graded high. Corrections: corrections@forensicpost.com.
- Emergency Directive 24-01: mitigate Ivanti Connect Secure and Ivanti Policy Secure vulnerabilitiesCybersecurity and Infrastructure Security Agency
- CVE-2023-46805 (authentication bypass) and CVE-2024-21887 (command injection)Ivanti