On January 10, 2024, cybersecurity firm Volexity dropped a bombshell: two critical zero-day vulnerabilities in Ivanti Connect Secure and Policy Secure VPNs are being actively exploited in the wild. The disclosure sent shockwaves through enterprise security teams worldwide, as more than 17,000 exposed gateways were identified as vulnerable to remote compromise. With Bitcoin trading at $46,627 and Ethereum at $2,582 amid the frenzy of spot ETF approvals, the timing underscored how traditional infrastructure vulnerabilities can ripple into crypto-adjacent markets where secure remote access is paramount.
The Exploit Mechanics
The attack chain hinges on two vulnerabilities working in concert. CVE-2023-46805, rated CVSS 8.2 (High), is an authentication bypass flaw in the web component of Ivanti Connect Secure. It exploits a path traversal vulnerability through an unauthenticated endpoint, allowing attackers to bypass authentication mechanisms entirely. Once past the authentication gate, CVE-2024-21887 — a critical CVSS 9.1 command injection vulnerability — enables attackers to inject and execute arbitrary payloads on the compromised system.
The combination is devastating. An attacker needs no credentials, no prior access, and no user interaction. By chaining these two flaws, threat actors can achieve unauthenticated remote code execution on VPN gateways that organizations rely on to secure their most sensitive remote connections. Volexity reported that the vulnerabilities were being exploited by a sophisticated threat actor, with evidence of active compromise predating the public disclosure.
Affected Systems
The vulnerabilities affect Ivanti Connect Secure (formerly Pulse Connect Secure) versions 9.x and 22.x, as well as Ivanti Policy Secure versions 9.x and 22.x. These products are widely deployed across government agencies, financial institutions, healthcare organizations, and enterprise networks. Volexity’s scanning revealed more than 17,000 Connect Secure and Policy Secure gateways exposed to the internet, creating a massive attack surface.
For cryptocurrency exchanges, custody providers, and blockchain infrastructure companies that rely on VPN-secured access for remote operations and cold wallet management, the implications are severe. A compromised VPN gateway could provide attackers with a foothold into internal networks, potentially exposing private keys, seed phrases, and transaction authorization workflows.
The Mitigation Strategy
Ivanti released a mitigation guidance on January 10, urging all affected customers to apply the recommended configuration changes immediately. The Cybersecurity and Infrastructure Security Agency (CISA) issued an emergency directive on January 19, mandating that federal agencies implement mitigations within 48 hours. Organizations were advised to:
- Apply Ivanti’s XML mitigation file to all affected gateways immediately
- Run the Ivanti Integrity Checker Tool to detect signs of compromise
- Monitor VPN logs for unusual administrative activity and unexpected configuration changes
- Restrict administrative access to VPN gateways from trusted IP ranges only
- Consider deploying additional network segmentation between VPN gateways and critical infrastructure
A full patch was not immediately available, making the mitigation measures particularly urgent. Organizations with crypto-related operations should treat VPN gateway compromise as a potential key exposure event and rotate credentials, review access logs, and verify the integrity of wallet management systems.
Lessons Learned
The Ivanti zero-days reinforce several critical security principles. First, VPN appliances are high-value targets because they sit at the network perimeter and provide access to internal systems. Second, the lack of multi-factor authentication on the VPN management interface itself — not just user connections — creates a dangerous blind spot. Third, organizations must maintain an up-to-date inventory of all internet-facing assets and their firmware versions to respond rapidly to zero-day disclosures.
The speed of exploitation also merits attention. Volexity’s findings indicated that threat actors were exploiting these vulnerabilities before the public disclosure, highlighting the reality of the zero-day marketplace and the importance of behavior-based detection alongside signature-based defenses.
User Action Required
If your organization uses Ivanti Connect Secure or Policy Secure, treat this as an emergency. Apply the mitigation guidance from Ivanti’s security advisory immediately. Run the Integrity Checker Tool and review logs for signs of compromise dating back to at least December 2023. For crypto businesses, extend the investigation to include wallet management systems, key custody infrastructure, and any systems accessible through the VPN. Rotate all credentials that may have been exposed and consider engaging a third-party incident response team if compromise indicators are found.
Disclaimer: This article is for informational purposes only and does not constitute professional security advice. Always consult with qualified cybersecurity professionals for specific guidance on vulnerability remediation.
17,000 exposed gateways and the exploit chain is just two CVEs chained together. auth bypass + command injection. classic and devastating.
two CVEs, 17000 vulnerable hosts, and the exploit was a textbook chain. auth bypass into RCE. this is security 101 stuff that should have been caught in code review
CVSS 9.1 command injection on a VPN appliance that sits at the network edge. the exploit chain was inevitable once auth bypass was possible
Our SOC team spent the entire weekend patching Ivanti appliances after this dropped. Volexity did solid work on the disclosure. The MITRE ATT&CK mapping was helpful.
the inventory problem is the real vulnerability in every org. you cannot patch what you do not know exists. ivanti boxes rotting in DMZs everywhere
our team was patching through the weekend too. the MITRE mapping helped but the real problem was inventory. half the org did not even know they had Ivanti boxes exposed
and this is why you dont expose management interfaces to the internet. VPN concentrators are perimeter devices, not public web servers