diff --git a/src/messaging/ExchangeMgr.cpp b/src/messaging/ExchangeMgr.cpp
index 0063aa5d22264a..a50672417ed7f2 100644
--- a/src/messaging/ExchangeMgr.cpp
+++ b/src/messaging/ExchangeMgr.cpp
@@ -236,7 +236,13 @@ void ExchangeManager::OnMessageReceived(const PacketHeader & packetHeader, const
                         packetHeader.GetDestinationGroupId().Value());
     }
 
-    // Do not handle unsolicited messages on a inactive session.
+    // Do not handle messages that don't match an existing exchange on a
+    // inactive session, since we should not be creating new exchanges there.
+    if (!session->IsActiveSession()) {
+        ChipLogProgress(ExchangeManager, "Dropping message on inactive session that does not match an existing exchange");
+        return;
+    }
+
     // If it's not a duplicate message, search for an unsolicited message handler if it is marked as being sent by an initiator.
     // Since we didn't find an existing exchange that matches the message, it must be an unsolicited message. However all
     // unsolicited messages must be marked as being from an initiator.
diff --git a/src/transport/SecureSession.cpp b/src/transport/SecureSession.cpp
index 7db899ffa7bf6d..106ce1a6cba5de 100644
--- a/src/transport/SecureSession.cpp
+++ b/src/transport/SecureSession.cpp
@@ -46,6 +46,10 @@ const char * SecureSession::StateToString(State state) const
         return "kPendingEviction";
         break;
 
+    case State::kInactive:
+        return "kInactive";
+        break;
+
     default:
         return "???";
         break;
@@ -89,9 +93,12 @@ void SecureSession::MarkAsDefunct()
 
     case State::kInactive:
         //
-        // Once a session is marked Inactive, we CANNOT bring it back to either being active or defunct.
+        // Once a session is marked Inactive, we CANNOT bring it back to either
+        // being active or defunct.  But consumers may not really know this
+        // session is already inactive.  Just ignore the call and stay in
+        // kInactive state.
         //
-        FALLTHROUGH;
+        return;
     case State::kPendingEviction:
         //
         // Once a session is headed for eviction, we CANNOT bring it back to either being active or defunct.
diff --git a/src/transport/SecureSession.h b/src/transport/SecureSession.h
index 45c05d02e422e2..3868a0063cd28f 100644
--- a/src/transport/SecureSession.h
+++ b/src/transport/SecureSession.h
@@ -144,6 +144,7 @@ class SecureSession : public Session, public ReferenceCounted<SecureSession, Sec
     bool IsEstablishing() const { return mState == State::kEstablishing; }
     bool IsPendingEviction() const { return mState == State::kPendingEviction; }
     bool IsDefunct() const { return mState == State::kDefunct; }
+    bool IsInactive() const { return mState == State::kInactive; }
     const char * GetStateStr() const { return StateToString(mState); }
 
     /*
diff --git a/src/transport/SessionManager.cpp b/src/transport/SessionManager.cpp
index 3a4ceca37ff7db..e1a3de91fbd723 100644
--- a/src/transport/SessionManager.cpp
+++ b/src/transport/SessionManager.cpp
@@ -532,7 +532,7 @@ void SessionManager::SecureUnicastMessageDispatch(const PacketHeader & packetHea
 
     Transport::SecureSession * secureSession = session.Value()->AsSecureSession();
 
-    if (!secureSession->IsDefunct() && !secureSession->IsActiveSession())
+    if (!secureSession->IsDefunct() && !secureSession->IsActiveSession() && !secureSession->IsInactive())
     {
         ChipLogError(Inet, "Secure transport received message on a session in an invalid state (state = '%s')",
                      secureSession->GetStateStr());