CISA Lists Ivanti Connect Secure in KEV as Volexity Maps Exploit Path

Key points

• CISA placed Ivanti Connect Secure on its Known Exploited Vulnerabilities list in mid-October.
• Volexity documented how attackers chain flaws to compromise the appliance.
• The listing signals confirmed real-world abuse, not theoretical risk.
• K-12 and government admins should treat internet-facing Ivanti gear as high priority.

In mid-October, CISA added Ivanti's Connect Secure remote-access appliance to the Known Exploited Vulnerabilities list. Separately, Volexity published research describing a sequence of attacker actions that can be combined against the product. The two developments point to the same conclusion: the platform is being targeted in real intrusions, not just lab scenarios.

Connect Secure is commonly deployed at the network edge to broker remote sessions, so organizations running it—including school districts and public-sector agencies—face elevated exposure. Because the device often sits in front of internal resources, a compromise can give intruders a foothold for lateral movement and credential theft.

The KEV addition changes the risk calculation for defenders. It is a formal signal that exploitation has been observed, and it puts federal remediation timelines in play. Volexity's write-up of the attack path gives incident responders concrete behaviors to hunt for, but it also lowers the barrier for less sophisticated adversaries who can follow published techniques.

Ivanti edge products have drawn repeated scrutiny from security researchers and government responders. The absence of CVE identifiers in the current facts does not reduce urgency; the KEV listing and vendor-adjacent research are enough to justify immediate review. Mid-October timing means many teams may already be inside patch windows or change freezes.

Watch for updated Ivanti guidance, revised KEV due dates, and any Volexity indicators that expand the known attack surface. Administrators should also monitor for unusual authentication patterns, unexpected appliance changes, and outbound traffic from the gateway.

What to do now

1. Inventory every Ivanti Connect Secure instance, including internet-facing and remote-access deployments, and assign an owner.
2. Apply the latest Ivanti security fixes and configuration guidance; do not wait for a CVE-specific trigger if the vendor has published mitigation.
3. Review the CISA KEV entry and meet the applicable remediation deadline; document exceptions with risk acceptance.
4. Use Volexity's published attack-path details to hunt for signs of compromise across authentication logs, appliance configuration changes, and outbound connections.
5. Reduce exposure by restricting management interfaces, enforcing MFA, and segmenting the appliance from critical internal systems.
6. If compromise indicators appear, isolate the device, preserve logs, rotate credentials, and engage incident response before restoring service.
7. Subscribe to Ivanti, CISA, and Volexity advisories for updates and re-check the KEV listing for changes.

Original source

Security Affairs