[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fIvhn1-NXQQjEcz8RWiffFFZR_yV10AqD8uVT7CZaEhs":3},{"article":4,"iocs":54,"watch_terms":59,"solutions":60,"lesson":151},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":31,"category":32,"article_tags":36},"c2847283-210f-4385-8ff9-358d474d2925","Ivanti misses opportunity to fix vulnerability before attackers got to work and made it a zero-day","ivanti-misses-opportunity-to-fix-vulnerability-before-attackers-got-to-work-and--4faf74","The security vendor said it initially discovered a portion of the defect during internal security checks in June, but the company said it didn’t meet the threshold for an out-of-band release. The post Ivanti misses opportunity to fix vulnerability before attackers got to work and made it a zero-day appeared first on CyberScoop.","Ivanti is facing scrutiny after attackers exploited a chain of three zero-day vulnerabilities in its Connect Secure VPN product. While Ivanti discovered a portion of the flaw internally in June, it was not deemed critical enough for an out-of-band fix and was scheduled for a regular release. A threat actor, UTA0576, exploited these vulnerabilities to bypass authentication, execute code remotely, and escalate privileges, leading to credential theft and data exfiltration for a limited number of customers. CISA has added the vulnerability to its known exploited vulnerabilities catalog and urged immediate patching, cautioning that Ivanti's own integrity checker tool may not detect exploitation.","Ivanti missed fixing a zero-day vulnerability before attackers exploited it, leading to customer compromises.","https:\u002F\u002Fcyberscoop.com\u002Fivanti-connect-secure-zero-day-actively-exploited\u002F","https:\u002F\u002Fcyberscoop.com\u002Fwp-content\u002Fuploads\u002Fsites\u002F3\u002F2025\u002F04\u002FWAWPWY.jpg","2026-10-13T22:10:42+00:00","2026-10-14T00:00:17.832193+00:00",9,[17,20,23,26,29],{"name":18,"type":19},"Ivanti Connect Secure","product",{"name":21,"type":22},"Ivanti","vendor",{"name":24,"type":25},"UTA0576","threat_actor",{"name":27,"type":28},"VPN","technology",{"name":30,"type":28},"Active Directory","80544778-fabb-4dcd-aa35-17492e5dcf4f",{"id":31,"icon":33,"name":34,"slug":35},null,"Vulnerabilities","vulnerabilities",[37,42,47,49],{"category":38},{"id":39,"icon":33,"name":40,"slug":41},"574f766a-fb3f-487c-8d2c-0720ae75471b","Zero-day","zero-day",{"category":43},{"id":44,"icon":33,"name":45,"slug":46},"6cbdd207-aaa1-4176-9534-e156b125e917","Nation-state","nation-state",{"category":48},{"id":31,"icon":33,"name":34,"slug":35},{"category":50},{"id":51,"icon":33,"name":52,"slug":53},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[55],{"type":56,"value":57,"context":58},"cve","CVE-2026-104935","Identified vulnerability in Ivanti Connect Secure",[21,18],{"controls":61,"vendors":147},[62,91,119],{"slug":63,"name":64,"problem":65,"products":66},"vulnerability-management","Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",[67,75,83],{"vendor_slug":68,"vendor_name":69,"vendor_logo":70,"product_slug":71,"product_name":72,"url":73,"description":74},"qualys","Qualys","\u002Fvendor-logos\u002Fqualys.png","vmdr","Qualys VMDR","https:\u002F\u002Fwww.qualys.com\u002Fapps\u002Fvulnerability-management-detection-response\u002F","Vulnerability management, detection and response with risk-based prioritisation.",{"vendor_slug":76,"vendor_name":77,"vendor_logo":78,"product_slug":79,"product_name":80,"url":81,"description":82},"rapid7","Rapid7","\u002Fvendor-logos\u002Frapid7.png","insightvm","Rapid7 Exposure Command (InsightVM)","https:\u002F\u002Fwww.rapid7.com\u002Fproducts\u002Finsightvm\u002F","Vulnerability scanning and risk-based prioritisation; InsightVM is now part of Exposure Command, alongside attack surface and cloud risk.",{"vendor_slug":84,"vendor_name":85,"vendor_logo":86,"product_slug":87,"product_name":88,"url":89,"description":90},"tenable","Tenable","\u002Fvendor-logos\u002Ftenable.png","tenable-vulnerability-management","Tenable Vulnerability Management","https:\u002F\u002Fwww.tenable.com\u002Fproducts\u002Fvulnerability-management","Cloud-based vulnerability scanning and prioritisation, built on Nessus.",{"slug":92,"name":93,"problem":94,"products":95},"patch-management","Automated patch management","Known holes get closed in days, not months.",[96,104,111],{"vendor_slug":97,"vendor_name":98,"vendor_logo":99,"product_slug":100,"product_name":101,"url":102,"description":103},"action1","Action1","\u002Fvendor-logos\u002Faction1.png","action1-patch-management","Action1 Patch Management","https:\u002F\u002Fwww.action1.com\u002F","Cloud-native patch management for Windows, macOS and third-party applications.",{"vendor_slug":105,"vendor_name":21,"vendor_logo":106,"product_slug":107,"product_name":108,"url":109,"description":110},"ivanti","\u002Fvendor-logos\u002Fivanti.png","neurons-patch-management","Ivanti Neurons for Patch Management","https:\u002F\u002Fwww.ivanti.com\u002Fproducts\u002Fivanti-neurons-for-patch-management","Risk-based patch management for operating systems and third-party applications.",{"vendor_slug":112,"vendor_name":113,"vendor_logo":114,"product_slug":115,"product_name":116,"url":117,"description":118},"ninjaone","NinjaOne","\u002Fvendor-logos\u002Fninjaone.png","ninjaone-patch-management","NinjaOne Patch Management","https:\u002F\u002Fwww.ninjaone.com\u002Fpatch-management\u002F","Automated patching of operating systems and third-party applications from the cloud.",{"slug":53,"name":120,"problem":121,"products":122},"Threat intelligence","Attack campaigns reach your sector, suppliers or software before your team hears about them.",[123,131,139],{"vendor_slug":124,"vendor_name":125,"vendor_logo":126,"product_slug":127,"product_name":128,"url":129,"description":130},"recorded-future","Recorded Future","\u002Fvendor-logos\u002Frecorded-future.png","recorded-future-cyber-operations","Recorded Future Cyber Operations","https:\u002F\u002Fwww.recordedfuture.com\u002Fproducts\u002Fcyber-operations","Threat intelligence built into security operations workflows, to prioritise alerts and act on threats before they arrive.",{"vendor_slug":132,"vendor_name":133,"vendor_logo":134,"product_slug":135,"product_name":136,"url":137,"description":138},"google","Google","\u002Fvendor-logos\u002Fgoogle.png","google-threat-intelligence","Google Threat Intelligence","https:\u002F\u002Fcloud.google.com\u002Fsecurity\u002Fproducts\u002Fthreat-intelligence","Threat intelligence from Mandiant's frontline investigations, Google's threat analysts, open sources and Google's own visibility, in one service.",{"vendor_slug":140,"vendor_name":141,"vendor_logo":142,"product_slug":143,"product_name":144,"url":145,"description":146},"defused","Defused","\u002Fvendor-logos\u002Fdefused.png","defused-tf","Defused TF","https:\u002F\u002Fdefusedcyber.com\u002Fproduct\u002Ftf","Threat intelligence feed from honeypots Defused runs on several continents, showing which vulnerabilities attackers are exploiting right now, with payloads and indicators.",[148],{"slug":105,"name":21,"logo_path":106,"roles":149},[150],"affected",{"slug":152,"title":153,"body":154,"framework_refs":155,"framework_notes":166},"ivantis-delayed-patch-allowed-zero-day-exploit-chain-to-emerge","Ivanti's Delayed Patch Allowed Zero-Day Exploit Chain to Emerge","Ivanti internally discovered a vulnerability in June but underestimated its severity, choosing to defer the fix to a regular release cycle rather than issuing an emergency out-of-band patch. This decision gave threat actor UTA0576 the window needed to chain three vulnerabilities together, enabling authentication bypass, remote code execution, and privilege escalation. The case illustrates how even vendor-discovered flaws can become zero-days if triage processes fail to account for chaining potential and attacker ingenuity. Compounding the damage, Ivanti's own integrity checker tool was found to be unreliable for detecting exploitation, leaving defenders with a false sense of security. CISA's intervention underscores that VPN appliances are high-value targets that demand accelerated remediation timelines.",[156,157,158,159,160,161,162,163,164,165],"CIS Control 7: Continuous Vulnerability Management","CIS Control 12: Network Infrastructure Management","CIS Control 4: Secure Configuration of Enterprise Assets","NIST SP 800-40 Rev. 4: Guide to Enterprise Patch Management Planning","NIST IR-6: Incident Reporting","NIST SI-2: Flaw Remediation","NIST RA-5: Vulnerability Monitoring and Scanning","CISA Known Exploited Vulnerabilities (KEV) Catalog","ITIL Change Management: Emergency Change Procedures","ISO\u002FIEC 27001 A.12.6.1: Management of Technical Vulnerabilities",{"NIST SI-2: Flaw Remediation":167,"NIST IR-6: Incident Reporting":168,"NIST RA-5: Vulnerability Monitoring and Scanning":169,"CIS Control 12: Network Infrastructure Management":170,"CIS Control 7: Continuous Vulnerability Management":171,"CISA Known Exploited Vulnerabilities (KEV) Catalog":172,"ITIL Change Management: Emergency Change Procedures":173,"CIS Control 4: Secure Configuration of Enterprise Assets":174,"ISO\u002FIEC 27001 A.12.6.1: Management of Technical Vulnerabilities":175,"NIST SP 800-40 Rev. 4: Guide to Enterprise Patch Management Planning":176},"Requires timely remediation, which Ivanti's deferred fix did not provide.","Reporting incidents quickly helps vendors and customers respond to exploitation.","Scanning identifies Ivanti devices that need patching or mitigation.","Network infrastructure management covers securing appliances like Ivanti gateways.","Continuous vulnerability management, including rapid application of vendor fixes, limits zero-day chain risk.","Exploited Ivanti flaws listed in KEV need fast remediation.","Emergency change procedures would have allowed an out-of-band Ivanti patch.","Secure configuration reduces exposure while vendor patches are delayed.","Requires timely action on technical vulnerabilities, not deferral to routine releases.","Patch planning should push vendors and internal teams to treat severe flaws as emergencies."]