Ivanti Zero-Day Chain Exploited Before Patches Available
Written by AI from the linked story. Not reviewed by an editor. How this works
Threat actor UTA0576 chained multiple zero-day vulnerabilities in Ivanti Connect Secure to achieve root-level access, steal credentials, and exfiltrate sensitive data — all before patches were available. This incident highlights the extreme risk posed by internet-facing VPN appliances, which are high-value targets precisely because they sit at the perimeter and often run with elevated privileges. The chaining of vulnerabilities demonstrates how attackers can escalate impact dramatically when multiple unpatched flaws exist in the same product. CISA's addition of these CVEs to the Known Exploited Vulnerabilities catalog underscores the urgency of treating VPN infrastructure as critical attack surface requiring near-real-time monitoring and rapid response.
Tactical Insight
Immediate actions
- Apply Ivanti's latest patches for CVE-2026-111357 and CVE-2026-118527 immediately across all Connect Secure deployments.
- Perform integrity checks and threat hunts on Ivanti appliances to identify indicators of compromise from UTA0576.
- Rotate all credentials that may have passed through or been stored on affected VPN systems.
Long-term improvements
- Implement a formal emergency patching SLA (e.g., 24–48 hours) specifically for internet-facing appliances listed in the CISA KEV catalog.
- Maintain a continuously updated inventory of all network edge devices, including VPN gateways, to ensure no asset is missed during patching campaigns.
- Enforce network segmentation so that VPN concentrators cannot directly reach sensitive internal systems without additional authentication and inspection.
Detection measures
- Deploy behavioural monitoring and anomaly detection on VPN appliances to flag unusual privilege escalation or bulk data transfers.
- Subscribe to vendor security advisories and CISA KEV feed alerts to receive zero-day notifications within minutes of publication.
- Enable centralised logging of all VPN authentication events and forward them to a SIEM for real-time correlation against known threat actor TTPs.