[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$ffGfaaDiVw_C4KG2c7ZvKvnUYrB4S_RNwpQeOJU5YRxk":3},{"article":4,"iocs":54,"watch_terms":65,"solutions":66,"lesson":161},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":31,"category":32,"article_tags":36},"70c05ded-ea3f-4a18-8837-38412250809b","U.S. CISA adds Ivanti Connect Secure flaws to its Known Exploited Vulnerabilities catalog","u-s-cisa-adds-ivanti-connect-secure-flaws-to-its-known-exploited-vulnerabilities-8cfd90","U.S. Cybersecurity and Infrastructure Security Agency (CISA) adds Ivanti Connect Secure flaws to its Known Exploited Vulnerabilities catalog. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added the following Ivanti Connect Secure vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog: The vulnerabilities are part of an exploit chain that cybersecurity firm Volexity first documented in mid-October. “Volexity […]","CISA has added multiple Ivanti Connect Secure vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog. These flaws, part of an exploit chain documented by Volexity, were actively exploited in the wild by threat actor UTA0576. The attacks leveraged authentication bypass, remote code execution, and privilege escalation to gain root access, targeting Active Directory credentials and sensitive data.","CISA adds Ivanti Connect Secure flaws to its Known Exploited Vulnerabilities catalog.","https:\u002F\u002Fsecurityaffairs.com\u002F202175\u002Fsecurity\u002Fu-s-cisa-adds-ivanti-connect-secure-flaws-to-its-known-exploited-vulnerabilities-catalog.html","https:\u002F\u002Fsecurityaffairs.com\u002Fwp-content\u002Fuploads\u002F2020\u002F07\u002FCISA.jpeg","2026-10-31T19:33:36+00:00","2026-10-31T21:00:02.371019+00:00",9,[17,20,23,26,29],{"name":18,"type":19},"Ivanti Connect Secure","product",{"name":21,"type":22},"Ivanti","vendor",{"name":24,"type":25},"UTA0576","threat_actor",{"name":27,"type":28},"VPN","technology",{"name":30,"type":28},"Active Directory","80544778-fabb-4dcd-aa35-17492e5dcf4f",{"id":31,"icon":33,"name":34,"slug":35},null,"Vulnerabilities","vulnerabilities",[37,42,47,49],{"category":38},{"id":39,"icon":33,"name":40,"slug":41},"217d3263-c763-41ca-875e-06901f522fe0","NIST","nist",{"category":43},{"id":44,"icon":33,"name":45,"slug":46},"6cbdd207-aaa1-4176-9534-e156b125e917","Nation-state","nation-state",{"category":48},{"id":31,"icon":33,"name":34,"slug":35},{"category":50},{"id":51,"icon":33,"name":52,"slug":53},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[55,59,62],{"type":56,"value":57,"context":58},"cve","CVE-2026-111357","Missing authentication check vulnerability in Ivanti Connect Secure",{"type":56,"value":60,"context":61},"CVE-2026-118527","Predictable identifier vulnerability in Ivanti Connect Secure",{"type":56,"value":63,"context":64},"CVE-2026-104935","Authentication bypass and RCE vulnerability in Ivanti Connect Secure",[21,18],{"controls":67,"vendors":155},[68,97,126],{"slug":69,"name":70,"problem":71,"products":72},"vulnerability-management","Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",[73,81,89],{"vendor_slug":74,"vendor_name":75,"vendor_logo":76,"product_slug":77,"product_name":78,"url":79,"description":80},"axonius","Axonius","\u002Fvendor-logos\u002Faxonius.png","axonius-exposures","Axonius Exposures","https:\u002F\u002Fwww.axonius.com\u002Fplatform\u002Fexposures","Brings findings from different scanners together with asset and business context, to show what matters most and track fixes to the end.",{"vendor_slug":82,"vendor_name":83,"vendor_logo":84,"product_slug":85,"product_name":86,"url":87,"description":88},"tenable","Tenable","\u002Fvendor-logos\u002Ftenable.png","tenable-vulnerability-management","Tenable Vulnerability Management","https:\u002F\u002Fwww.tenable.com\u002Fproducts\u002Fvulnerability-management","Cloud-based vulnerability scanning and prioritisation, built on Nessus.",{"vendor_slug":90,"vendor_name":91,"vendor_logo":92,"product_slug":93,"product_name":94,"url":95,"description":96},"rapid7","Rapid7","\u002Fvendor-logos\u002Frapid7.png","insightvm","Rapid7 Exposure Command (InsightVM)","https:\u002F\u002Fwww.rapid7.com\u002Fproducts\u002Finsightvm\u002F","Vulnerability scanning and risk-based prioritisation; InsightVM is now part of Exposure Command, alongside attack surface and cloud risk.",{"slug":98,"name":99,"problem":100,"products":101},"patch-management","Automated patch management","Known holes get closed in days, not months.",[102,110,118],{"vendor_slug":103,"vendor_name":104,"vendor_logo":105,"product_slug":106,"product_name":107,"url":108,"description":109},"ninjaone","NinjaOne","\u002Fvendor-logos\u002Fninjaone.png","ninjaone-patch-management","NinjaOne Patch Management","https:\u002F\u002Fwww.ninjaone.com\u002Fpatch-management\u002F","Automated patching of operating systems and third-party applications from the cloud.",{"vendor_slug":111,"vendor_name":112,"vendor_logo":113,"product_slug":114,"product_name":115,"url":116,"description":117},"manageengine","ManageEngine","\u002Fvendor-logos\u002Fmanageengine.png","patch-manager-plus","ManageEngine Patch Manager Plus","https:\u002F\u002Fwww.manageengine.com\u002Fpatch-management\u002F","Patch management for operating systems and third-party applications, on premises or in the cloud.",{"vendor_slug":119,"vendor_name":120,"vendor_logo":121,"product_slug":122,"product_name":123,"url":124,"description":125},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","intune","Microsoft Intune","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fmicrosoft-intune","Device management for Windows, macOS, iOS and Android, including update rings and compliance policies.",{"slug":127,"name":128,"problem":129,"products":130},"network-segmentation","Network segmentation and microsegmentation","One compromised machine can no longer reach everything else.",[131,139,147],{"vendor_slug":132,"vendor_name":133,"vendor_logo":134,"product_slug":135,"product_name":136,"url":137,"description":138},"threatlocker","ThreatLocker","\u002Fvendor-logos\u002Fthreatlocker.png","zero-trust-endpoint-firewall","Zero Trust Endpoint Firewall","https:\u002F\u002Fwww.threatlocker.com\u002Fcapabilities\u002Fzero-trust-endpoint-firewall","Centrally managed host firewall with device-level and dynamic access rules, to limit which machines can talk to each other.",{"vendor_slug":140,"vendor_name":141,"vendor_logo":142,"product_slug":143,"product_name":144,"url":145,"description":146},"illumio","Illumio","\u002Fvendor-logos\u002Fillumio.png","illumio-segmentation","Illumio Segmentation","https:\u002F\u002Fwww.illumio.com\u002Fillumio-segmentation","Maps traffic between workloads and enforces segmentation across data centre, cloud and endpoints.",{"vendor_slug":148,"vendor_name":149,"vendor_logo":150,"product_slug":151,"product_name":152,"url":153,"description":154},"akamai","Akamai","\u002Fvendor-logos\u002Fakamai.png","guardicore-segmentation","Akamai Guardicore Segmentation","https:\u002F\u002Fwww.akamai.com\u002Fproducts\u002Fakamai-guardicore-segmentation","Software-based microsegmentation with traffic visibility.",[156],{"slug":157,"name":21,"logo_path":158,"roles":159},"ivanti","\u002Fvendor-logos\u002Fivanti.png",[160],"affected",{"slug":162,"title":163,"body":164,"framework_refs":165,"framework_notes":173},"ivanti-connect-secure-exploit-chain-hits-kev-catalog-after-active-exploitation","Ivanti Connect Secure Exploit Chain Hits KEV Catalog After Active Exploitation","Threat actor UTA0576 chained multiple Ivanti Connect Secure vulnerabilities — including authentication bypass, remote code execution, and privilege escalation — to achieve root-level access on targeted systems. These flaws were actively exploited in the wild before many organizations applied available patches, demonstrating the critical gap between vulnerability disclosure and remediation. The attackers specifically targeted Active Directory credentials and sensitive data, amplifying the blast radius well beyond the initial entry point. This incident underscores that internet-facing VPN appliances are high-value targets requiring prioritized, rapid patching cycles and continuous exposure monitoring.",[166,167,168,169,170,171,172],"CIS Control 7: Continuous Vulnerability Management","NIST SP 800-53 SI-2: Flaw Remediation","NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control","ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities","OWASP A06:2021 Vulnerable and Outdated Components","NIS2 Article 21(2)(b)","MITRE ATT&CK T1566: Phishing",{"NIS2 Article 21(2)(b)":174,"MITRE ATT&CK T1566: Phishing":175,"NIST SP 800-53 SI-2: Flaw Remediation":176,"OWASP A06:2021 Vulnerable and Outdated Components":177,"CIS Control 7: Continuous Vulnerability Management":178,"ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities":179,"NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control":180},"NIS2 mandates incident handling and vulnerability management practices for essential entities; failure to remediate known exploited flaws in critical network infrastructure breaches these obligations.","While the primary vector here is vulnerability exploitation rather than phishing, the subsequent credential harvesting against Active Directory aligns with ATT&CK's credential access tactics, highlighting the need for layered defences beyond the initial entry point.","SI-2 requires organizations to identify, report, and correct information system flaws on a defined schedule — a process that would have closed the authentication bypass and RCE vulnerabilities before active exploitation occurred.","The attack exploited unpatched, known-vulnerable components in a widely deployed network appliance, exactly the risk class OWASP A06 targets with guidance on tracking and updating third-party software.","Routine vulnerability scanning and a defined remediation timeline would have identified the Ivanti flaws and enforced patching before UTA0576 could weaponize the exploit chain.","This control requires timely identification and remediation of technical vulnerabilities in information systems, directly addressing the failure to patch Ivanti Connect Secure before exploitation.","The exploit chain began with an authentication bypass; enforcing strong identity controls and monitoring authentication anomalies on VPN infrastructure would have raised early detection or blocked initial access."]