U.S. CISA adds Ivanti Connect Secure flaws to its Known Exploited Vulnerabilities catalog

Threat actor UTA0576 chained multiple Ivanti Connect Secure vulnerabilities — including authentication bypass, remote code execution, and privilege escalation — to achieve root-level access on targeted systems. These flaws were actively exploited in the wild before many organizations applied available patches, demonstrating the critical gap between vulnerability disclosure and remediation. The attackers specifically targeted Active Directory credentials and sensitive data, amplifying the blast radius well beyond the initial entry point. This incident underscores that internet-facing VPN appliances are high-value targets requiring prioritized, rapid patching cycles and continuous exposure monitoring.