Ivanti Connect Secure
Ivanti's remote-access VPN appliance, formerly Pulse Connect Secure.
CISA ordered federal agencies to disconnect every Ivanti Connect Secure appliance by 2 February 2024, a step it has not taken against Cisco, whose tally of exploited flaws on the CISA list hit 100 on 30 September 2026.
Last refreshed: 12 October 2026
Why did CISA once order agencies to unplug Ivanti Connect Secure?
Timeline for Ivanti Connect Secure
Named as Ivanti Connect Secure
Cybersecurity: Threats and Defences: Mentioned in: Cisco reaches 100 entries on CISA's listMentioned in: F5 reclassifies DoS bug to 9.8 RCE
Cybersecurity: Threats and DefencesBackground
Ivanti Connect Secure is the remote-access VPN appliance Ivanti previously sold as Pulse Connect Secure. The product line holds 14 entries on CISA's Known Exploited Vulnerabilities catalogue, the most recent added in April 2025.
Exploitation of CVE-2023-46805 and CVE-2024-21887 led CISA to issue Emergency Directive 24-01 on 19 January 2024. Supplemental direction then required agencies to unplug every Connect Secure and Policy Secure instance by 2 February 2024. CISA has not gone that FAR with Cisco, despite repeated listings of its security products.
The older Pulse code still turns up in attacks. Joint advisory AA26-281A of 8 October 2026 included CVE-2019-11510, a 2019 Pulse Connect Secure flaw.