[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fhIj5mB7xAj7cNOzQz0eRexsbjHvZvgCPj1USKCOmklw":3},{"article":4,"iocs":55,"watch_terms":70,"solutions":71,"lesson":165},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":32,"category":33,"article_tags":37},"1e562546-8ba4-4e9b-b4a3-5c6eddf52fd9","Attacker Chains Three Ivanti Connect Secure Zero-Days for Root Access, Only Two Patched So Far","attacker-chains-three-ivanti-connect-secure-zero-days-for-root-access-only-two-p-ea27b5","An attacker chained three zero-day flaws in Ivanti Connect Secure, a VPN appliance, to run commands as root without logging in, security firm Volexity said on October 13. Ivanti has released fixes for two of the flaws and told customers on affected versions to \"act immediately.\" A fix for the third is still pending, according to Volexity. Volexity, which reported the flaws to Ivanti,","Attackers are chaining three zero-day vulnerabilities in Ivanti Connect Secure VPN appliances to gain root access. Security firm Volexity discovered the exploit, which allows attackers to run commands without logging in. Ivanti has released patches for two of the three flaws, urging immediate action, while a fix for the third is still pending. The threat actor, tracked as UTA0576, has been observed exploiting these vulnerabilities in the wild, leading to credential theft and password spraying attacks.","Three Ivanti Connect Secure zero-days chained for root access; two patched, one pending.","https:\u002F\u002Fthehackernews.com\u002F2026\u002F10\u002Fattacker-chains-three-ivanti-connect.html","https:\u002F\u002Fblogger.googleusercontent.com\u002Fimg\u002Fb\u002FR29vZ2xl\u002FAVvXsEhZSH26NsXmSsQGaAbhNyJLMaBQKFCmabIbFZ_yi2sUGXjHQOVztQEQfXLarEAx1Fl9lRwGAryBE4zZEooJ4cochODcB4x8wQnPl3MRWiyBcpyEV6i8VPxvwcLHmShQVZVhuOcTjMXRhHAlx4Y0Uo85c74EVU4cea84YgXju02I9jlNzcGOFtLfa_am82Q\u002Fs1600\u002Fivanti-hack.jpg","2026-10-13T17:33:11+00:00","2026-10-13T20:00:20.499827+00:00",9,[17,20,22,24,27,30],{"name":18,"type":19},"Connect Secure","product",{"name":21,"type":19},"Xtraction",{"name":23,"type":19},"Neurons Patch for Intune",{"name":25,"type":26},"UTA0576","threat_actor",{"name":28,"type":29},"Ivanti","vendor",{"name":31,"type":29},"Volexity","80544778-fabb-4dcd-aa35-17492e5dcf4f",{"id":32,"icon":34,"name":35,"slug":36},null,"Vulnerabilities","vulnerabilities",[38,43,48,50],{"category":39},{"id":40,"icon":34,"name":41,"slug":42},"574f766a-fb3f-487c-8d2c-0720ae75471b","Zero-day","zero-day",{"category":44},{"id":45,"icon":34,"name":46,"slug":47},"6cbdd207-aaa1-4176-9534-e156b125e917","Nation-state","nation-state",{"category":49},{"id":32,"icon":34,"name":35,"slug":36},{"category":51},{"id":52,"icon":34,"name":53,"slug":54},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[56,60,63,66],{"type":57,"value":58,"context":59},"cve","CVE-2026-104935","Chained authentication bypass and RCE flaws in Ivanti Connect Secure",{"type":57,"value":61,"context":62},"CVE-2026-106042","Flaw in Ivanti Xtraction",{"type":57,"value":64,"context":65},"CVE-2026-109412","Flaw in Ivanti Neurons Patch for Intune",{"type":67,"value":68,"context":69},"ip","108.165.147.64","IP address used by attacker UTA0576",[28,31,18],{"controls":72,"vendors":159},[73,102,130],{"slug":74,"name":75,"problem":76,"products":77},"vulnerability-management","Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",[78,86,94],{"vendor_slug":79,"vendor_name":80,"vendor_logo":81,"product_slug":82,"product_name":83,"url":84,"description":85},"tenable","Tenable","\u002Fvendor-logos\u002Ftenable.png","tenable-vulnerability-management","Tenable Vulnerability Management","https:\u002F\u002Fwww.tenable.com\u002Fproducts\u002Fvulnerability-management","Cloud-based vulnerability scanning and prioritisation, built on Nessus.",{"vendor_slug":87,"vendor_name":88,"vendor_logo":89,"product_slug":90,"product_name":91,"url":92,"description":93},"axonius","Axonius","\u002Fvendor-logos\u002Faxonius.png","axonius-exposures","Axonius Exposures","https:\u002F\u002Fwww.axonius.com\u002Fplatform\u002Fexposures","Brings findings from different scanners together with asset and business context, to show what matters most and track fixes to the end.",{"vendor_slug":95,"vendor_name":96,"vendor_logo":97,"product_slug":98,"product_name":99,"url":100,"description":101},"rapid7","Rapid7","\u002Fvendor-logos\u002Frapid7.png","insightvm","Rapid7 Exposure Command (InsightVM)","https:\u002F\u002Fwww.rapid7.com\u002Fproducts\u002Finsightvm\u002F","Vulnerability scanning and risk-based prioritisation; InsightVM is now part of Exposure Command, alongside attack surface and cloud risk.",{"slug":103,"name":104,"problem":105,"products":106},"patch-management","Automated patch management","Known holes get closed in days, not months.",[107,114,122],{"vendor_slug":108,"vendor_name":109,"vendor_logo":110,"product_slug":103,"product_name":111,"url":112,"description":113},"qualys","Qualys","\u002Fvendor-logos\u002Fqualys.png","Qualys Patch Management","https:\u002F\u002Fwww.qualys.com\u002Fapps\u002Fpatch-management\u002F","Patch deployment for operating systems and third-party applications, linked to vulnerability findings.",{"vendor_slug":115,"vendor_name":116,"vendor_logo":117,"product_slug":118,"product_name":119,"url":120,"description":121},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","intune","Microsoft Intune","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fmicrosoft-intune","Device management for Windows, macOS, iOS and Android, including update rings and compliance policies.",{"vendor_slug":123,"vendor_name":124,"vendor_logo":125,"product_slug":126,"product_name":127,"url":128,"description":129},"ninjaone","NinjaOne","\u002Fvendor-logos\u002Fninjaone.png","ninjaone-patch-management","NinjaOne Patch Management","https:\u002F\u002Fwww.ninjaone.com\u002Fpatch-management\u002F","Automated patching of operating systems and third-party applications from the cloud.",{"slug":131,"name":132,"problem":133,"products":134},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",[135,143,151],{"vendor_slug":136,"vendor_name":137,"vendor_logo":138,"product_slug":139,"product_name":140,"url":141,"description":142},"sophos","Sophos","\u002Fvendor-logos\u002Fsophos.png","sophos-endpoint","Sophos Endpoint","https:\u002F\u002Fwww.sophos.com\u002Fen-us\u002Fproducts\u002Fendpoint-security","Endpoint protection with Intercept X anti-ransomware technology and EDR.",{"vendor_slug":144,"vendor_name":145,"vendor_logo":146,"product_slug":147,"product_name":148,"url":149,"description":150},"withsecure","WithSecure","\u002Fvendor-logos\u002Fwithsecure.png","elements-xdr","WithSecure Elements XDR","https:\u002F\u002Fwww.withsecure.com\u002Fen\u002Ffor-business\u002Fplatform\u002Fxdr\u002F","Endpoint detection and response with extended detection, on the Elements cloud platform.",{"vendor_slug":152,"vendor_name":153,"vendor_logo":154,"product_slug":155,"product_name":156,"url":157,"description":158},"crowdstrike","CrowdStrike","\u002Fvendor-logos\u002Fcrowdstrike.png","falcon-insight-xdr","Falcon Insight XDR","https:\u002F\u002Fwww.crowdstrike.com\u002Fen-us\u002Fplatform\u002Fendpoint-security\u002Ffalcon-insight-xdr\u002F","Endpoint detection and response with extended detection across other security tools.",[160],{"slug":161,"name":28,"logo_path":162,"roles":163},"ivanti","\u002Fvendor-logos\u002Fivanti.png",[164],"affected",{"slug":166,"title":167,"body":168,"framework_refs":169,"framework_notes":181},"chained-zero-days-in-ivanti-vpn-grant-attackers-root-access","Chained Zero-Days in Ivanti VPN Grant Attackers Root Access","Threat actor UTA0576 exploited three chained zero-day vulnerabilities in Ivanti Connect Secure VPN appliances, achieving unauthenticated root-level command execution — one of the most severe possible outcomes for an internet-facing device. The attack chain demonstrates how unpatched, perimeter-facing appliances can serve as a direct gateway to internal networks and credential stores. With one of the three flaws still unpatched, organizations remain exposed even after applying available fixes. This incident highlights how VPN gateways, trusted precisely because they control access, become high-value targets that demand accelerated patch cycles and compensating controls when patches are unavailable.",[170,171,172,173,174,175,176,177,178,179,180],"CIS Control 7: Continuous Vulnerability Management","CIS Control 12: Network Infrastructure Management","CIS Control 13: Network Monitoring and Defense","NIST SP 800-40 Rev. 4: Guide to Enterprise Patch Management","NIST SI-2: Flaw Remediation","NIST SC-7: Boundary Protection","NIST IR-4: Incident Handling","CISA Known Exploited Vulnerabilities (KEV) Catalog","NIST AC-17: Remote Access","ISO\u002FIEC 27001: A.12.6.1 Management of Technical Vulnerabilities","ITIL: Problem Management \u002F Emergency Change Advisory Board (eCAB)",{}]