Emergency Directive 24-01
CISA directive of January 2024 ordering federal mitigation of Ivanti Connect Secure flaws.
Under Emergency Directive 24-01, CISA told US federal agencies on 31 January 2024 to unplug every affected Ivanti Connect Secure and Policy Secure product by 2 February, then rebuild it and treat linked domain accounts as compromised.
Last refreshed: 12 October 2026
Why did CISA order agencies to unplug their Ivanti VPNs?
Timeline for Emergency Directive 24-01
Named as Emergency Directive 24-01
Cybersecurity: Threats and Defences: Mentioned in: Cisco reaches 100 entries on CISA's listBackground
CISA issued Emergency Directive 24-01 on 19 January 2024 to deal with two exploited flaws, CVE-2023-46805 and CVE-2024-21887, in Ivanti Connect Secure and Ivanti Policy Secure, Ivanti's remote-access gateways.
The first instruction was to apply Ivanti's mitigation by 22 January and hunt for signs of compromise. Supplemental direction followed on 31 January: agencies had to disconnect every affected product by 2 February 2024, rebuild it, and treat any linked domain accounts as compromised. A second supplement in February brought a third flaw, CVE-2024-22024, under the order.
Its disconnection order sets ED 24-01 apart from routine patch deadlines. Cisco reached 100 entries in CISA's exploited catalogue on 30 September 2026 after four security-product listings in three weeks, yet its repeated listings have drawn patch orders and never an instruction to unplug.