The Ivanti Emergency Directive: What It Teaches Us About VPN Risk

In January 2024, CISA issued Emergency Directive 24-01 in response to active exploitation of vulnerabilities in Ivanti Connect Secure and Ivanti Policy Secure products. The directive required federal agencies to apply mitigations within three days, but continued monitoring showed attackers had developed workarounds to those mitigations. A supplemental direction soon followed, ordering agencies to disconnect all instances of the affected products and complete specific actions before returning them to service.

The underlying incident is worth examining closely—not just for what it says about the specific exploited products, but for what it reveals about the broader security model that gave the attackers such an advantage.

Two Chained Vulnerabilities, Total Appliance Control

Attack activity began as early as December 2023, per forensic analyses published by Volexity. The attackers chained two previously unknown vulnerabilities to achieve unauthenticated remote code execution on the Ivanti appliances:

  • CVE-2023-46805 — an authentication bypass vulnerability in the products' web components, allowing a remote attacker to bypass access controls and reach restricted resources.
  • CVE-2024-21887 — a command injection vulnerability in the same web components, letting an authenticated administrator execute arbitrary commands on the appliance.

Chained together, the flaws let an unauthenticated remote attacker be treated as an authenticated administrator, then run arbitrary commands. Once in control of an appliance, the threat actor was able to harvest credentials from users logging into the VPN, use those credentials to reach protected systems and collect more credentials, modify files on the appliance to support remote code execution, deploy web shells across multiple servers, establish reverse tunnels back to their command-and-control server, and disable or clear logging to avoid detection.

Why the "Moat" Itself Became the Target

CISA's directive is justified given the severity of the exposures Ivanti customers faced. But the incident also illustrates a deeper structural weakness in the legacy castle-and-moat security model. The VPN appliance serves as the moat — the single security layer responsible for authenticating users and connecting them to protected resources. Attacks are supposed to be stopped at that boundary. The problem is that this model assumes the moat will never be breached.

Two characteristics inherent to vendor-supplied appliances — and to the legacy architecture they sit in — created the conditions for this kind of incident:

  • Administrators have access to the internals of the appliance, which means gaining privileged access to the box grants near-total control over it.
  • Authenticated users get broad, indiscriminate access to applications and resources across the corporate network. Once an attacker has valid credentials, that wide access enables easy lateral movement.

Least Privilege and the Cloudflare One Approach

Cloudflare One is Cloudflare's single-vendor SASE platform. Two of its design principles directly address the risk patterns exposed by this incident. First, it applies Zero Trust principles, including the principle of least privilege. Users who authenticate successfully see only the applications and resources required for their role, not the whole network. If credentials do get compromised, the attacker's lateral movement is constrained, and the blast radius is significantly smaller than with traditional VPN access.

Second, Cloudflare One doesn't offer any external access to the internals of Cloudflare's platform. Customer administrators can configure their own policies and services, but they never get the kind of underlying system access that attackers exploited on the Ivanti appliances — access that allowed them to modify files, disable logging, and establish persistent control.

Replacing the Legacy VPN

For organizations subject to the CISA directive—or any organization ready to move beyond legacy VPN infrastructure—Cloudflare's Zero Trust Network Access (ZTNA) service, available as part of Cloudflare One, provides a path to connect any user to any application without exposing the whole network. Cloudflare offers onboarding assistance and architecture workshops for organizations looking to augment or replace an existing Ivanti or other VPN deployment.

Organizations can also review Cloudflare's learning path on VPN replacement or consult its SASE reference architecture to understand how the platform's security services and on-ramps fit together.