Is my Ivanti Connect Secure VPN a risk?

What is Ivanti Connect Secure?

Ivanti Connect Secure, Policy Secure, and ZTA Gateways Stack-Based Buffer Overflow Vulnerability 2025-01-08 Ivanti Connect Secure, Policy Secure, and ZTA Gateways contain a stack-based buffer overflow which can lead to unauthenticated remote code execution.

Ivanti Connect Secure is a VPN appliance. Its sign-in page faces the internet so staff can connect from outside.

Why does it matter?

Ivanti Connect Secure Authentication Bypass by Spoofing Vulnerability 2026-10-13 Ivanti Connect Secure contains an authentication bypass by spoofing vulnerability that allows a remote unauthenticated attacker to execute arbitrary commands.

On 13 October 2026 CISA added an Ivanti Connect Secure flaw to its catalog of exploited flaws. CISA says it lets a remote attacker with no account run commands.

It follows an earlier flaw, added on 8 January 2025, that could lead to remote code execution without a sign-in.

Is patching enough?

Run an external Integrity Checker Tool (ICT). For more guidance, see Ivanti's instructions . Conduct threat hunt actions on any systems connected to-or recently connected to-the affected Ivanti device. If threat hunting actions determine no compromise: For the highest level of confidence, conduct a factory reset.

Not on its own. CISA's instructions for the January 2025 flaw say to run Ivanti's external integrity checker first. For the highest level of confidence, conduct a factory reset.

What do I do about it?

1. Install Ivanti's fixed version as soon as it is available.
2. Run Ivanti's external Integrity Checker Tool.
3. Factory reset the appliance, then patch it.
4. Reset the admin password, stored keys and local user passwords on the gateway.