Ivanti Patches Two More Zero-Days Exploited in Connect Secure Attack Chain

Threat actor UTA0576 chained multiple zero-day vulnerabilities in Ivanti Connect Secure to achieve root-level access, steal credentials, and exfiltrate sensitive data — all before patches were available. This incident highlights the extreme risk posed by internet-facing VPN appliances, which are high-value targets precisely because they sit at the perimeter and often run with elevated privileges. The chaining of vulnerabilities demonstrates how attackers can escalate impact dramatically when multiple unpatched flaws exist in the same product. CISA's addition of these CVEs to the Known Exploited Vulnerabilities catalog underscores the urgency of treating VPN infrastructure as critical attack surface requiring near-real-time monitoring and rapid response.