Ivanti misses opportunity to fix vulnerability before attackers got to work and made it a zero-day

Ivanti internally discovered a vulnerability in June but underestimated its severity, choosing to defer the fix to a regular release cycle rather than issuing an emergency out-of-band patch. This decision gave threat actor UTA0576 the window needed to chain three vulnerabilities together, enabling authentication bypass, remote code execution, and privilege escalation. The case illustrates how even vendor-discovered flaws can become zero-days if triage processes fail to account for chaining potential and attacker ingenuity. Compounding the damage, Ivanti's own integrity checker tool was found to be unreliable for detecting exploitation, leaving defenders with a false sense of security. CISA's intervention underscores that VPN appliances are high-value targets that demand accelerated remediation timelines.