CISA orders Ivanti devices targeted by Chinese hackers be disconnected

CISA ordered federal agencies to disconnect Ivanti Connect Secure and Ivanti Policy Secure devices after researchers and vendors reported broad, active exploitation of multiple zero-day vulnerabilities by suspected Chinese-linked espionage actors (tracked as UNC5221 and others). The exploited flaws reportedly allow trivial command execution and internal network pivoting on internet-facing VPN appliances; Ivanti and security researchers published remediation steps but CISA recommended taking devices offline, factory resetting, patching, and only returning them to service after validated remediation.