CISA: Federal Agencies Must Disconnect Vulnerable Ivanti Appliances

CISA on Wednesday told federal agencies to temporarily disconnect all instances of Ivanti Connect Secure and Policy Secure appliances from agency networks within 48 hours, as Ivanti continues to grapple with two widely exploited vulnerabilities in these products.

The new guidance comes less than two weeks after CISA issued an emergency directive giving federal agencies a hard deadline to implement mitigations for the two flaws (CVE-2024-21887 and CVE-2023-46805), and ordering federal agencies to apply updates to impacted products within 48 …

agency cisa connect emergency emergency directive exploited exploited vulnerabilities federal federal agencies guidance ivanti ivanti connect secure networks policy products vulnerabilities vulnerable