Ivanti Connect Secure Zero-Days Exploited to Steal Credentials and Access Federal Networks
Written by AI from the linked story. Not reviewed by an editor. How this works
Three Ivanti Connect Secure vulnerabilities were actively exploited as zero-days before patches were widely applied, enabling attackers to gain network access, harvest credentials, and query sensitive data. The incident highlights the acute risk posed by internet-facing VPN and remote access appliances, which are high-value targets due to their privileged position on the network perimeter. Federal agencies' reliance on these systems without sufficient compensating controls amplified the blast radius when exploitation occurred. The CISA mandate for both patching and forensic investigation underscores that remediation alone is insufficient — organizations must also determine whether compromise already occurred.
Tactical Insight
Immediate actions
- Apply Ivanti's latest patches or mitigations for CVE-2026-111357, CVE-2026-118527, and CVE-2026-104935 across all affected instances immediately.
- Conduct forensic triage on all Ivanti Connect Secure appliances to determine whether exploitation or credential theft has already occurred.
- Reset all credentials and session tokens that may have transited or been stored on affected Ivanti appliances.
Long-term improvements
- Maintain a complete, continuously updated inventory of all internet-facing network appliances and prioritize them in vulnerability scanning cycles.
- Establish emergency patching SLAs (e.g., 24–72 hours) specifically for critical internet-facing infrastructure when active exploitation is confirmed.
- Implement network segmentation so that VPN concentrators and remote access gateways cannot directly reach sensitive internal systems without additional authentication.
Detection measures
- Deploy centralized logging and SIEM alerting for anomalous authentication events, unusual credential queries, and unexpected lateral movement originating from VPN gateway IP ranges.
- Subscribe to CISA's Known Exploited Vulnerabilities (KEV) catalog feed and automate alerts when any catalogued CVE matches assets in your environment.
- Perform regular threat-hunting exercises targeting remote access infrastructure to detect post-exploitation persistence mechanisms.