Ivanti Connect Secure has become a forced migration rather than an optional upgrade. Two things pushed it over the line at once: an aggressive support model that retires software in roughly nine-month windows, and the sudden end-of-life of the ISA 6000 and 8000 hardware after DDR4 memory production stopped. Layer on a relentless run of actively exploited pre-authentication flaws and the maths is simple. Buying the next ISA box keeps the same internet-facing weakness; moving remote access to Zero Trust Network Access (ZTNA) removes it.
Key takeaways
- Ivanti’s N-2 policy supports only the current and two previous minor releases, about nine months of coverage, and there is no in-place upgrade from 22.7.x to 25.1.3.x.
- The ISA 6000 and 8000 lose physical support on 31 January 2027 because DDR4 chips are no longer made; contracts that ran to 2028 are effectively void.
- Ivanti Connect Secure has carried a steady stream of exploited zero-days, including CVE-2025-0282 (9.8) and CVE-2025-22457, the latter reverse-engineered from a “low-risk” bug fix by a China-nexus actor.
- Post-exploitation malware such as TRAILBLAZE and BRUSHFIRE runs in memory and tampers with the Integrity Checker Tool, so a patch does not prove a box is clean.
- Running an end-of-life gateway breaks CyFun’s mandatory Security Updates control and can void your cyber insurance, where Belgian cover runs €200 to €400 per user per year.
The support and hardware reality
Ivanti runs an N-2 support policy on its modern stack: full support covers the current minor release and the two before it, a rolling window of roughly nine months. That forces a continuous upgrade treadmill, and the treadmill has gaps. There is no direct, in-place path from 22.7.x to the 25.1.3.x branch. For virtual deployments you stand up entirely new 25.x instances and migrate configuration by hand.
Hardware made it worse. In mid-2025 Ivanti brought the ISA 6000 and 8000 end-of-life early because RAM manufacturers halted DDR4 production, and these appliances depend on 16 GB DDR4 modules. Many organisations had only recently moved off legacy Pulse Secure Appliances to the ISA line, buying support contracts through 2028 on the assumption of a ten-year lifecycle. Physical support now ends on 31 January 2027 and will not extend, so the ISA 6000 delivers about 4.7 years of service against an expected ten. Running 25.x on-premises after that means buying the next-generation ISA 6500 or 8500, an unplanned capital outlay.
| Platform | End of Support / End of Life | Pathway |
|---|---|---|
| PSA 300c / 3000 / 5000 (physical) | EOS 31 Dec 2024 / EOL 23 Dec 2025 | ISA 6000 or ZTNA |
| PSA 700c / 7000f (physical) | EOS 31 Dec 2024 / EOL 23 Dec 2025 | ISA 8000 or ZTNA |
| PSA-V (virtual) | EOS 31 Dec 2024 / EOL 23 Dec 2025 | ISA-V series or ZTNA |
| ISA 6000 / 8000 (physical) | Accelerated EOS/EOL 31 Jan 2027 (DDR4) | ISA 6500 / 8500 or ZTNA |
| ICS 9.1x (classic software) | EOS 31 Dec 2024 / EOL 23 Dec 2025 | Modern 22.x / 25.x or ZTNA |
| ICS 22.7 / 22.8 (software) | EOS 31 Jan 2027 | 25.x or ZTNA |
A perimeter that keeps getting breached
Ivanti Connect Secure has to listen on public ports to accept connections, which keeps it under constant scanning and targeted attack. The 2024 to 2026 window brought a continuous series of critical, actively exploited flaws.
| CVE | CVSS / KEV | Type and impact |
|---|---|---|
| CVE-2024-21887 | 9.1 / Jan 2024 | Command injection; arbitrary commands with admin privileges |
| CVE-2024-8963 | 9.4 / Sep 2024 | Path traversal in the Cloud Service Appliance, chained to run code |
| CVE-2025-0282 | 9.8 / Jan 2025 | Pre-auth stack overflow; RCE and credential harvesting; SPAWNMOLE/SPAWNSNAIL/SPAWNSLOTH |
| CVE-2025-22457 | 9.0 / Apr 2025 | Stack overflow in the HTTP server; in-memory RCE bypassing the Integrity Checker (UNC5221) |
| CVE-2026-1602 | 6.5 / Mar 2026 | SQL injection in Endpoint Manager, targeting Active Directory |
| CVE-2026-10520 | 10.0 / Jun 2026 | Pre-auth OS command injection in Ivanti Sentry, exploited within 24 hours of disclosure |
CVE-2025-22457 is the one that should end the “we will just patch” argument. Ivanti fixed the underlying bug on 11 February 2025 but classified it as a low-risk product defect, reasoning that its digits-and-periods input filter made exploitation unlikely. A China-nexus group monitored the update, reverse-engineered it, and found the stack overflow in the /home/bin/web binary. Within about four business days, researchers could build a working exploit. The attackers then ran a non-persistent, in-memory chain: a dropper called TRAILBLAZE injected a passive backdoor called BRUSHFIRE into the running web process, hooking the SSL_read API, and they modified the appliance’s Integrity Checker Tool so it would not flag the tampering. A patched appliance can still be a compromised appliance, which is why patching alone does not put you back to safe.
Mapping Ivanti Connect Secure to ZTNA
Migrating off the appliance means translating each ICS feature into a Zero Trust equivalent that does not rely on a public listener or network-level trust.
| Legacy ICS feature | Risk | ZTNA replacement |
|---|---|---|
| Full-tunnel remote access VPN | Broad network access; lateral movement if an endpoint is compromised | Client-to-application tunnel; access limited to authorised apps |
| End-user web portal and bookmarks | Bookmarks exposed on a public page; brute-force and web exploits | Clientless ZTNA with browser isolation |
| Admin / web console access | Exposed /admin portals invite credential stuffing | Broker-fronted admin gateways hidden from the WAN, behind hardware-bound MFA |
| Split tunneling | DNS leaks and routing conflicts | Dynamic app-route routing and split DNS at the client |
| Active/passive hardware clustering | Complex VIP state sync and heartbeat timeouts | Cloud-native scaling across redundant gateways |
| Local / Active Directory auth | Credential harvesting and offline brute force | Modern IdP integration (SAML 2.0 / OIDC), passwordless, conditional access |
The cutover is phased and avoids downtime. First, map every internal application, protocol and subnet currently reached through ICS, and turn those into identity- and posture-based policies. Second, deploy ZTNA connectors alongside the existing appliances; the connectors make outbound-only connections, so you open no inbound ports and users can validate on both systems in parallel. Third, move user groups across, power down the Ivanti appliances, revoke their edge certificates, and close the inbound WAN ports.
Refresh the hardware, switch appliance, or move to ZTNA
Most teams facing the ISA end-of-life weigh three routes.
| Criterion | Stay on Ivanti (ISA 6500/8500) | Another appliance (F5, Kemp, Cisco) | EU-sovereign ZTNA |
|---|---|---|---|
| Capital expenditure | High; new hardware forced by DDR4 | High; new proprietary appliances | Zero; software-defined subscription |
| Migration complexity | High; no direct 22.7.x to 25.1.3.x path | Extreme; rebuild rules on a new platform | Low; identity mapping, app-by-app templates |
| Security model | Legacy perimeter, inbound ports | Legacy perimeter, public edge | Zero Trust, outbound-only, no public ports |
| Compliance (NIS2/CyFun) | Challenging; CVE-heavy history | Moderate; manual configuration | Native; built-in access monitoring, EU hosting |
| Sovereignty | Non-EU; offshore support | Non-EU; foreign surveillance exposure | EU-sovereign; local support |
A single-platform, EU-sovereign option such as Jimber removes the hardware dependency and the public listener in one move, and folds the pieces you would otherwise license separately into one console. If you are weighing the broader case for consolidation, our note on single-vendor versus multi-vendor SASE and the enterprise VPN end-of-life watchlist give the context, while the network isolation approach covers the mechanics.
The compliance and insurance angle in Belgium
Belgium transposed NIS2 through the law of 26 April 2024, with the CCB as supervisor. Essential entities had to submit a self-assessment or equivalence documentation by 18 April 2026 and must reach full certification by April 2027. The CyberFundamentals (CyFun) framework runs in tiers, Small (7 controls), Basic (34, blocking about 82% of common attacks), Important (133, about 94%), and Essential (218). CyFun’s Security Updates control is mandatory at every level, so running an end-of-life gateway such as a retired ISA after 31 January 2027 is a direct violation, and the CVE history of the platform works against the vulnerability-management controls at the Important tier. NIS2 and the newer CyFun 2025 also place personal liability on the board for approving and overseeing these measures.
Insurers reinforce the point. Qualifying for cover now requires documented alignment with CyFun or ISO 27001, proof of MFA, access controls and prompt patching. Running a known unpatched flaw or an out-of-support system is routine grounds for exclusions, premium hikes, or a denied claim, and Belgian cover for higher-risk organisations runs €200 to €400 per user per year, so keeping infrastructure supported is a direct financial lever.
Frequently asked questions
Can we export our Ivanti Connect Secure configuration and import it into a ZTNA platform?
No. ICS stores configuration in a proprietary XML format full of appliance-centric parameters like physical port bindings, cluster passwords and web rewriting rules. A ZTNA platform is identity- and context-aware. You can synchronise user directories and group mappings through Active Directory or SAML, but the access policies themselves are rebuilt as direct user-to-application mappings rather than broad network access.
How are authentication and MFA handled after moving off Ivanti?
ICS often leans on local authentication databases, LDAP or secondary auth settings on the appliance itself. A ZTNA platform integrates with modern identity providers over SAML 2.0 or OIDC, which enables single sign-on and lets you enforce conditional access and hardware-bound MFA tokens such as FIDO2 at the identity layer, removing the authentication database from the network edge.
What happens to our existing Ivanti licenses when we migrate?
Perpetual licenses are tied to the physical hardware and lose all value at End of Support. CONSEC-style subscription licenses cannot be transferred to another vendor. When you move platforms you can often use trade-in credits or vendor migration programmes to offset the unused portion of a legacy contract. Note that Ivanti also enforces a 90-day cancellation notice before renewal, and lapsed accounts can face a reinstatement fee around 10% of the renewal cost.
What is the financial impact of the accelerated ISA 6000/8000 end-of-life?
Because DDR4 chips are no longer produced, physical support ends on 31 January 2027. Organisations running these appliances either buy the next-generation ISA 6500/8500 to keep running 25.x on-premises or move to a cloud-native ZTNA platform. The first path is an unplanned capital cost on hardware you expected to run for another few years.
Can we run Ivanti and the new ZTNA platform side by side during migration?
Yes, and it is the standard approach. Lightweight ZTNA connectors sit alongside the existing ICS systems, so you migrate user groups in phases, validate application policies against the new platform, and keep downtime to a minimum before decommissioning the appliances.
How does Belgian CyFun treat an end-of-life access gateway?
Running end-of-life, unsupported or unpatched hardware directly violates CyFun’s Security Updates control, which is mandatory at every assurance level. Under the Belgian NIS2 law, continuing to operate unsupported edge systems can be recorded as a failure to implement adequate risk-management measures, which invites audits, management liability and fines.
Plan the exit, not the next box
If you run Ivanti Connect Secure, the deadlines are already set and the exploit history is not slowing down. Map your remote-access dependencies, stand up ZTNA connectors alongside the appliance, and migrate one user group this quarter instead of budgeting an ISA 6500. Book a Jimber demo to see an agentless, EU-sovereign migration path, or compare pricing against a hardware refresh.
