Critical Infrastructure Vulnerability Alerts

Here is what we know in order of discovery. On April 8th, CISA issued an emergency directive ordering federal agencies to patch a flaw in Ivanti EPMM — Ivanti's mobile device management platform — by Sunday of that week. That kind of hard deadline from CISA means the agency had evidence of active exploitation in the wild, not theoretical risk. Then, on April 21st, a second alert arrived: a separate vulnerability in SD-WAN infrastructure, also flagged as actively exploited. Two different products, two different attack surfaces, two weeks apart. The pattern is either coincidence or it is not.

If confirmed, here is what this means. Federal agencies running unpatched Ivanti EPMM installations have already been inside the window of exposure — the Sunday deadline suggests CISA believed attackers were moving fast, which means some agencies may have been compromised before the patch was applied. The SD-WAN vulnerability is, in some ways, the more alarming development: SD-WAN sits at the routing layer of enterprise and government networks, and active exploitation there means adversaries potentially have visibility into traffic flows, not just individual endpoints. The second-order effect is a picture of sustained, methodical targeting of network management infrastructure — the kind of quiet, structural access that intelligence operations favour over noisy ransomware. Any organisation running either product class, public sector or private, should treat this as a direct concern, not background noise.

Watch for attribution details emerging from either incident, and for CISA expanding its Known Exploited Vulnerabilities catalogue with additional Ivanti or SD-WAN entries in the coming weeks — that would confirm a coordinated campaign rather than opportunistic scanning.

NewsHive monitors these sources continuously. All signal titles above link to the original reporting.

Intelligence by NewsHive. Need help navigating what this means for your business? Contact GeekyBee →