On January 10, 2024, Ivanti publicly disclosed two vulnerabilities in its Connect Secure and Policy Secure gateways, and CISA added both to its Known Exploited Vulnerabilities catalog the same day. The disclosure did not describe a theoretical risk. It described flaws already being exploited in the wild, discovered because a security firm was investigating an intrusion rather than auditing code. That is why January 10 anchors this entry: it is the day the public learned of an attack that was already underway.
Individually, neither flaw was catastrophic. Chained together, they produced unauthenticated remote code execution on an appliance whose entire purpose is to sit at the network edge and decide who gets in. And in the weeks that followed, the story shifted from "patch this" to something more unsettling: the tools meant to tell defenders whether an appliance was compromised could not be fully trusted.
Two distinct weaknesses formed the chain. CVE-2023-46805 is an authentication bypass in the web component of Ivanti Connect Secure and Ivanti Policy Secure, classified under CWE-287 (improper authentication) and assigned a CVSS score of 8.2 (High). It lets an unauthenticated remote attacker bypass access controls and reach restricted resources that should have required a valid session.
CVE-2024-21887 is a command injection in the web components of the same products, classified under CWE-77 and assigned a CVSS score of 9.1 (Critical). On its own, this flaw requires an authenticated administrator—its high score reflects the severe impact of code execution, but it assumes the attacker already holds administrative access.
The chain is what removes that assumption. CVE-2023-46805 supplies the missing authentication, letting an attacker reach the command-injection endpoint without valid credentials; CVE-2024-21887 then supplies code execution. The combined result is unauthenticated remote code execution. Both supported major branches—the 9.x and 22.x versions—were affected.
Think of the appliance as a building with a guarded reception desk. The authentication-bypass flaw is a side door that lets an attacker walk past reception into hallways that were supposed to be badge-only. The command-injection flaw is a request that, when it reaches the right internal office, is treated not as data to be filed but as an instruction the building carries out. Filed data is inert; an instruction has side effects.
The command-injection flaw carried a Critical score precisely because the endpoint normally sat behind an administrative login—so the vendor's threat model assumed only a trusted admin could reach it. The authentication-bypass flaw invalidates that assumption. Once an external request can arrive at the vulnerable endpoint without authenticating, attacker-supplied input can enter an operating-system command context, and the appliance executes it.
The target matters as much as the mechanism. These gateways are edge devices with trusted access to internal networks and to the authentication data of the people who log in through them. After gaining code execution, attackers were observed modifying legitimate files, capturing credentials, deploying web shells for persistence, and using the compromised appliance as a foothold for lateral movement deeper into victim networks.
The security firm Volexity detected the activity in December 2023 while responding to an incident, identifying suspicious lateral movement and web shells that led back to the Ivanti appliances. Volexity tracked the initial actor as UTA0178 and assessed it as likely operating at the level of a Chinese nation-state—an attribution that should be cited to Volexity rather than stated as settled fact.
Early activity involved web shells that researchers named GLASSTOKEN and GIFTEDVISITOR. As investigations widened, additional malware families were reported in connection with exploitation of these appliances, including ZIPLINE, WARPWIRE, LIGHTWIRE and WIREFIRE. These names come from across multiple intrusions and reports; it would be wrong to imply that every family appeared in every compromise. Notably, attackers were observed trying to evade Ivanti's Integrity Checker Tool by modifying files and logs—a detail that becomes central to the remediation story.
Reported targeting spanned sectors including government, military, telecommunications and finance. CISA confirmed that two of its own systems were affected and were taken offline—a concrete, attributable data point rather than an estimate.
There is no authoritative global victim count in the supplied evidence, and counts of internet-exposed appliances measure exposure, not confirmed compromise. The two should not be conflated. The strongest documented impact is qualitative but severe: root-level access to affected appliances, deployment of web shells for persistence, theft of credentials, and lateral movement into internal networks. An edge gateway is a high-value foothold precisely because everything behind it tends to trust it.
Responding to an appliance compromise means capturing disk images, configuration exports and logs before a factory reset erases them. The Samsung T7 Portable SSD is fast, portable storage for incident-response evidence and forensic captures.
Amazon Affiliate Link
Ivanti initially provided mitigations while preparing patches, then released fixed Connect Secure builds—9.1R14.4, 9.1R17.2, 9.1R18.3, 22.4R2.2, 22.5R1.1 and 22.5R2.2—along with Policy Secure 22.5R1.1 and ZTA 22.6R1.3. But the defensive story was never as simple as installing a build.
CISA's response escalated in stages. It began with instructions to apply the mitigation and run an external integrity checker. It then issued Emergency Directive 24-01 on January 19, 2024. A Supplemental Direction followed, ordering federal agencies to disconnect the affected products by February 2, 2024, then factory-reset them, rebuild on supported software, reimport configuration and rotate credentials. A second supplemental update addressed a further vulnerability, CVE-2024-22024, and required additional February updates.
Two cautions dominate the remediation. First, Volexity reported that applying the mitigation did not remediate an existing compromise—if an attacker was already inside, the mitigation stopped new exploitation but not established persistence. Second, CISA warned that integrity checks could give false assurance in cases where attackers had manipulated the checker itself. Organizations were advised to assume domain credentials reachable from the appliance were compromised and to reset them. Later flaws in the same products—including CVE-2024-21888 and CVE-2024-21893—should be understood as separate issues, not folded into the original two-CVE chain.
The Ivanti chain crystallized a question that edge security had been avoiding: what happens when the security appliance cannot reliably attest to its own integrity? A firewall or VPN gateway is supposed to be the thing you trust to tell you the truth about your perimeter. When attackers can not only compromise it but also tamper with the tool that checks whether it was compromised, the usual remediation reflex—scan, confirm clean, move on—stops working.
The answer that emerged was uncomfortable but honest. Where an appliance's self-assessment cannot be trusted, remediation has to assume compromise rather than prove it: disconnect, rebuild from known-good software, rotate every credential the device could have seen. That is a far heavier response than patching, and the Ivanti events are why so many defenders now treat edge appliances as devices to be rebuilt, not merely updated.