Ivanti Connect Secure End of Life (EOL) Dates & Support Timeline

Ivanti Connect Secure lifecycle status — the real story

Ivanti Connect Secure is the enterprise VPN gateway with the most consequential exploitation history of any edge product this decade — its CVEs have repeatedly driven CISA emergency directives, and end-of-support edge devices are exactly what CISA's Binding Operational Directive 26-02 orders federal agencies to inventory and decommission. The product line spans three corporate eras under one lifecycle history: Juniper's IVE OS (1.0–7.4), Pulse Connect Secure 8.x/9.x (Pulse Secure, LLC), and Ivanti Connect Secure from the 22.x “Modern Stack” onward.

Ivanti publishes fixed per-release dates on its Granular Software Release EOL Timelines and Support Matrix, alongside a rolling “N-2” rule: the current minor release plus two previous minors receive full support (≈ nine months per minor). Two nuances matter when reading the table: End of Engineering is the last date for feature enhancements — after it, Ivanti says security updates and bug fixes continue only “on a limited-effort basis, as determined by Ivanti” — and the End of Support date is when support ends entirely. We map End of Engineering to this page's “active support” column and End of Support to the end-of-life column. The classic 9.x line is unambiguous: Ivanti's page states “This product is now End of Life and there is no longer any development on that platform.”

The date to circle: ICS 22.7, 22.8 and the 25.1.0/25.1.1/25.1.2 releases all reach End of Support on January 31, 2027 — days before the twelve-month decommissioning deadline of CISA BOD 26-02 (issued February 5, 2026) lands for US federal agencies. Newer sub-releases within the 25.1 line carry their own dates (25.1.3: April 30, 2027), so check the specific release you run. Patch-level build numbers live behind Ivanti's Supported Product Guide; this page tracks the release lines Ivanti publishes dates for.

Ivanti Connect Secure release and support pattern

Across the 15 release lines with a published release date, Ivanti Connect Secure has shipped a new line roughly every 6 months (median interval). A line typically stays supported for about 1.7 years from its release to its end-of-life date.

Of the 15 release lines tracked, 9 are past end of life and 6 are still within support. The newest line, 25.1.3, was released July 31, 2026. The next scheduled end of life is 25.1.2 on January 31, 2027 — 151 days from this build. The longest-supported line currently published is 25.1.3, to April 30, 2027.

Computed from the tracked release data at every build — the figures above are the dates in the table, restated, not an editorial estimate.

Ivanti Connect Secure security intelligence

CISA KEV history: Ivanti Connect Secure is named in CISA's Known Exploited Vulnerabilities catalog 13 times, most recently on 2025-04-04, including use in ransomware campaigns. Derived from CISA's live catalog at every build.

What does Ivanti Connect Secure end of life mean for your organization?

When a version of Ivanti Connect Secure reaches end of life, the maintainers stop issuing security patches. Vulnerabilities discovered after this date are publicly disclosed on the National Vulnerability Database, exploit code appears on GitHub, and your systems remain permanently exposed.

The CVE blind spot: Most vulnerability scanners check for known CVEs but do not flag the accumulation of unpatched vulnerabilities in EOL software. With a zero-day, nobody knows about the vulnerability. With EOL software, the vulnerability is public — listed, rated, and often weaponized — but no patch will ever exist. This is the most dangerous gap in enterprise security posture.

Organizations running EOL Ivanti Connect Secure should treat it as a vulnerability class in their risk register, apply compensating controls (network segmentation, enhanced monitoring, access restriction), and prioritize migration to a supported version.

Your options when Ivanti Connect Secure reaches end of life

There are four realistic paths. Which one is right depends far more on how long the system needs to keep running than on the version you are on today.

How to choose, in one question: how many more years does this system need to run? Under a year, extended support (where it exists) is usually cheaper than an emergency migration. One to three years, migrate — support purchased repeatedly costs more than doing the project once, and the project only gets harder as the version ages. Indefinitely, migrate now and plan the next migration before it surprises you.

Worth saying plainly, because vendors selling extended support rarely will: extended support is often the more expensive choice over a multi-year horizon. It is the right answer when a deadline is genuinely unreachable, not as a default. Compare the annual fee against the one-time cost of migrating before committing to either.

Formalizing decisions like this across your estate? Our free EOL policy template is a ready-to-adopt policy with risk tiers, remediation SLAs, and audit mapping — no signup, free to use and share.

Extended Support Options

If you cannot migrate immediately, extended support vendors provide continued security patches for EOL Ivanti Connect Secure versions. This is a bridge, not a permanent solution — plan your migration in parallel.

Related Products