CISA Flags Ivanti Connect Secure Flaws for Emergency Patching After In-the-Wild Exploits
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has moved a set of Ivanti Connect Secure vulnerabilities into its Known Exploited Vulnerabilities (KEV) catalog, Security Affairs reports. The flaws were abused in the wild as part of an exploit chain first documented by threat intelligence firm Volexity in mid-October, according to that report.
Each KEV entry carries a CVE identifier, the affected product, a required action and a remediation due date for U.S. federal agencies; the matching fixed builds are published in Ivanti's security advisories, and the CVEs and dates for this listing appear in CISA's KEV catalog. Security Affairs' report does not reproduce them.
The listing matters beyond the U.S. federal perimeter. KEV membership means CISA has determined there is credible evidence of active exploitation, which is precisely the justification the agency invokes when it compels agencies to patch on a fixed clock.
What KEV membership actually tells you
For security teams outside the U.S. federal system, the KEV catalog works less as a mandate and more as a public benchmark for urgency. When an edge-device flaw lands in KEV with a due date attached, that is the document you cite when requesting an emergency change window, an out-of-hours maintenance slot, or the budget to retire hardware the vendor has stopped fixing. It converts "we think this is serious" into "the lead cybersecurity agency of the U.S. government says it is being exploited now."
CISA attaches a remediation date to every KEV entry, and the deadline applies per CVE rather than to the listing as a whole — so a chain of flaws may carry more than one date. Pull each date from the catalog entry before scheduling the change.
Why VPN gateways remain the front door
Ivanti Connect Secure appliances sit at the network edge, terminate authenticated sessions, and are frequently exposed to the internet — a combination that makes them a perennial favorite for initial-access brokers who resell footholds to ransomware operators. Volexity's research, published on the firm's blog at volexity.com/blog, described the flaws being chained together rather than exploited in isolation, Security Affairs notes. That chaining detail matters: individually modest issues can combine into an unauthenticated-to-administrator path, which means partial patching — or mitigating only one CVE in the chain — leaves the door open.
Enterprise self-check checklist
- Inventory every instance — including standby, disaster-recovery, branch and acquired-company units, not just the production node you know about.
- Apply the fixed builds from Ivanti, then re-verify the version after reboot; appliances do not always report what you expect after an interrupted upgrade.
- Assume prior compromise. Patching closes the door; it does not evict a resident intruder. Hunt authentication and configuration-change logs, rotate credentials and keys, and invalidate sessions created before remediation.
- Enable outbound-connection alerting on the appliance and watch adjacent edge and identity infrastructure for lateral movement.
- Track the KEV due date for each applicable CVE and treat it as your escalation trigger if the patch is stuck in change approval.
A note on jurisdiction
CISA's Binding Operational Directive does not bind Hong Kong or regional enterprises. The exploitation activity, however, does not respect borders — and Ivanti appliances are deployed worldwide. Local teams can treat the KEV listing as an independent, vendor-neutral urgency signal rather than a compliance obligation.
Sources: Security Affairs; CISA Known Exploited Vulnerabilities catalog; Ivanti security advisories; Volexity research blog.
CISA 將 Ivanti Connect Secure 漏洞列入已知遭利用目錄 要求緊急修補
據 Security Affairs 報道，美國網絡安全及基礎設施安全局（CISA）已將一系列 Ivanti Connect Secure 漏洞納入其「已知遭利用漏洞」（Known Exploited Vulnerabilities，KEV）目錄。該報導指，相關漏洞此前已在實戰中遭濫用，屬於威脅情報公司 Volexity 於十月中旬首次記錄的 exploit chain 的一環。
每個 KEV 條目均載有 CVE 編號、受影響產品、須採取的行動，以及美國聯邦機構的修補到期日；對應的已修正版本刊載於 Ivanti 的安全公告，而本次收錄涉及的 CVE 及日期則見於 CISA 的 KEV 目錄。Security Affairs 的報導並未轉載這些資料。
該項收錄的影響不限於美國聯邦體系之內。列入 KEV 意味著 CISA 已判定存在正在遭積極利用的可信證據——這正是 CISA 強制各機構在指定期限內完成修補時所援引的理由。
KEV 收錄實際上告訴了你甚麼
對美國聯邦體系以外的安全團隊而言，KEV 目錄與其說是一項強制規定，不如說是一份公開的緊急程度基準。當邊界裝置漏洞連同到期日一併列入 KEV 時，這份文件正是你申請緊急變更時段、非辦公時間維護時段，或爭取預算以淘汰廠商已停止修補的硬件時所引用的依據。它把「我們認為問題很嚴重」轉化為「美國政府首席網絡安全機構表示該漏洞正遭利用中」。
CISA 為每項 KEV 條目都附上修補日期，該期限按每個 CVE 分別適用，而非以整份目錄統一計算——因此一組串連漏洞可能帶有一個以上的到期日。安排變更前，請先從目錄條目逐一取得各項日期。
為何 VPN 閘道仍是主要突破口
Ivanti Connect Secure 裝置位於網絡邊界，負責終止已認證的 session，且經常暴露於互聯網——這一組合使它們成為初始存取經紀人（initial-access broker）的長年最愛，這些經紀人將立足點轉售予勒索軟件營運者。Security Affairs 指出，Volexity 刊載於公司網誌 volexity.com/blog 的研究描述了這些漏洞是被串連利用，而非各自獨立遭利用。這項串連細節至關重要：個別看來並不嚴重的問題，結合後可構成一條由未經認證通往管理員權限的路徑，這意味著部分修補——或只緩解鏈條中的其中一個 CVE——仍會留下突破口。
企業自查清單
- 盤點每一個實例——包括待命節點、災難復原節點、分支機構及收購公司的裝置，而不僅是你所熟知的生產節點。
- 安裝 Ivanti 提供的修訂版本，然後於重啟後再次核實版本號；裝置在升級中斷後，未必會如預期般回報版本。
- 假設系統此前已被入侵。修補只是關上大門，並不能趕走已盤踞的入侵者。搜查認證及配置變更日誌，輪換憑證及密鑰，並使修補前建立的所有 session 失效。
- 在裝置上啟用外連線警報，同時監察相鄰的邊界及身份基礎設施，留意橫向移動（lateral movement）。
- 追蹤每個適用 CVE 的 KEV 到期日，若修補滯留於變更審批程序，即以此作為上報（escalation）的觸發點。
關於管轄權的說明
CISA 的《具約束力的行動指令》（Binding Operational Directive）並不約束香港或本區的企業。然而，利用活動本身並無邊界之分——而 Ivanti 裝置部署於全球各地。本地團隊可以將 KEV 收錄視為一個獨立、與廠商無關的緊急程度參考指標，而非合規義務。
資料來源：Security Affairs；CISA Known Exploited Vulnerabilities 目錄；Ivanti 安全公告；Volexity 研究網誌。