[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fA8tRwah16oBnC9x2bc2ar7wuCLuXo9YFF7Gu5A0g73w":3},{"article":4,"iocs":52,"watch_terms":63,"solutions":64,"lesson":154},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":29,"category":30,"article_tags":34},"f94a504b-3c66-4e8c-a76a-c8ef222c6aad","Ivanti Patches Two More Zero-Days Exploited in Connect Secure Attack Chain","ivanti-patches-two-more-zero-days-exploited-in-connect-secure-attack-chain-850d3b","CISA has added CVE-2026-111357 and CVE-2026-118527 to its KEV catalog after the Ivanti VPN flaws were chained in zero-day attacks. The post Ivanti Patches Two More Zero-Days Exploited in Connect Secure Attack Chain appeared first on SecurityWeek.","Ivanti has released patches for two additional zero-day vulnerabilities, CVE-2026-111357 and CVE-2026-118527, that were chained with a previously disclosed flaw in its Connect Secure VPN product. These vulnerabilities were exploited in the wild by a threat actor tracked as UTA0576, who used them to gain root privileges, steal credentials, and exfiltrate data. CISA has added these new vulnerabilities to its Known Exploited Vulnerabilities catalog, mandating federal agencies to patch them.","Ivanti patches two new zero-day vulnerabilities chained with a prior flaw in Connect Secure VPN.","https:\u002F\u002Fwww.securityweek.com\u002Fivanti-patches-two-more-zero-days-exploited-in-connect-secure-attack-chain\u002F","https:\u002F\u002Fwww.securityweek.com\u002Fwp-content\u002Fuploads\u002F2024\u002F02\u002FIvanti-Risks-Exploits.jpg","2026-11-02T07:57:49+00:00","2026-11-02T08:00:16.32428+00:00",9,[17,20,23,26],{"name":18,"type":19},"Connect Secure","product",{"name":21,"type":22},"Ivanti","vendor",{"name":24,"type":25},"UTA0576","threat_actor",{"name":27,"type":28},"VPN","technology","80544778-fabb-4dcd-aa35-17492e5dcf4f",{"id":29,"icon":31,"name":32,"slug":33},null,"Vulnerabilities","vulnerabilities",[35,40,42,47],{"category":36},{"id":37,"icon":31,"name":38,"slug":39},"574f766a-fb3f-487c-8d2c-0720ae75471b","Zero-day","zero-day",{"category":41},{"id":29,"icon":31,"name":32,"slug":33},{"category":43},{"id":44,"icon":31,"name":45,"slug":46},"c5eccf7c-abbc-4bd3-bbed-e6da5cba8e73","Incident Response","incident-response",{"category":48},{"id":49,"icon":31,"name":50,"slug":51},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[53,57,60],{"type":54,"value":55,"context":56},"cve","CVE-2026-111357","Privilege escalation zero-day exploited in Ivanti Connect Secure attacks.",{"type":54,"value":58,"context":59},"CVE-2026-118527","Predictable identifier generation vulnerability exploited in Ivanti Connect Secure attacks.",{"type":54,"value":61,"context":62},"CVE-2026-104935","Authentication bypass vulnerability in Ivanti Connect Secure, part of the attack chain.",[21,18],{"controls":65,"vendors":148},[66,95,120],{"slug":67,"name":68,"problem":69,"products":70},"vulnerability-management","Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",[71,79,87],{"vendor_slug":72,"vendor_name":73,"vendor_logo":74,"product_slug":75,"product_name":76,"url":77,"description":78},"qualys","Qualys","\u002Fvendor-logos\u002Fqualys.png","vmdr","Qualys VMDR","https:\u002F\u002Fwww.qualys.com\u002Fapps\u002Fvulnerability-management-detection-response\u002F","Vulnerability management, detection and response with risk-based prioritisation.",{"vendor_slug":80,"vendor_name":81,"vendor_logo":82,"product_slug":83,"product_name":84,"url":85,"description":86},"holm-security","Holm Security","\u002Fvendor-logos\u002Fholm-security.png","holm-security-platform","Holm Security Platform","https:\u002F\u002Fwww.holmsecurity.com\u002F","Vulnerability scanning of systems, web applications, cloud and the external attack surface, plus phishing simulation.",{"vendor_slug":88,"vendor_name":89,"vendor_logo":90,"product_slug":91,"product_name":92,"url":93,"description":94},"rapid7","Rapid7","\u002Fvendor-logos\u002Frapid7.png","insightvm","Rapid7 Exposure Command (InsightVM)","https:\u002F\u002Fwww.rapid7.com\u002Fproducts\u002Finsightvm\u002F","Vulnerability scanning and risk-based prioritisation; InsightVM is now part of Exposure Command, alongside attack surface and cloud risk.",{"slug":96,"name":97,"problem":98,"products":99},"patch-management","Automated patch management","Known holes get closed in days, not months.",[100,108,116],{"vendor_slug":101,"vendor_name":102,"vendor_logo":103,"product_slug":104,"product_name":105,"url":106,"description":107},"manageengine","ManageEngine","\u002Fvendor-logos\u002Fmanageengine.png","patch-manager-plus","ManageEngine Patch Manager Plus","https:\u002F\u002Fwww.manageengine.com\u002Fpatch-management\u002F","Patch management for operating systems and third-party applications, on premises or in the cloud.",{"vendor_slug":109,"vendor_name":110,"vendor_logo":111,"product_slug":112,"product_name":113,"url":114,"description":115},"ninjaone","NinjaOne","\u002Fvendor-logos\u002Fninjaone.png","ninjaone-patch-management","NinjaOne Patch Management","https:\u002F\u002Fwww.ninjaone.com\u002Fpatch-management\u002F","Automated patching of operating systems and third-party applications from the cloud.",{"vendor_slug":72,"vendor_name":73,"vendor_logo":74,"product_slug":96,"product_name":117,"url":118,"description":119},"Qualys Patch Management","https:\u002F\u002Fwww.qualys.com\u002Fapps\u002Fpatch-management\u002F","Patch deployment for operating systems and third-party applications, linked to vulnerability findings.",{"slug":51,"name":121,"problem":122,"products":123},"Threat intelligence","Attack campaigns reach your sector, suppliers or software before your team hears about them.",[124,132,140],{"vendor_slug":125,"vendor_name":126,"vendor_logo":127,"product_slug":128,"product_name":129,"url":130,"description":131},"defused","Defused","\u002Fvendor-logos\u002Fdefused.png","defused-tf","Defused TF","https:\u002F\u002Fdefusedcyber.com\u002Fproduct\u002Ftf","Threat intelligence feed from honeypots Defused runs on several continents, showing which vulnerabilities attackers are exploiting right now, with payloads and indicators.",{"vendor_slug":133,"vendor_name":134,"vendor_logo":135,"product_slug":136,"product_name":137,"url":138,"description":139},"google","Google","\u002Fvendor-logos\u002Fgoogle.png","google-threat-intelligence","Google Threat Intelligence","https:\u002F\u002Fcloud.google.com\u002Fsecurity\u002Fproducts\u002Fthreat-intelligence","Threat intelligence from Mandiant's frontline investigations, Google's threat analysts, open sources and Google's own visibility, in one service.",{"vendor_slug":141,"vendor_name":142,"vendor_logo":143,"product_slug":144,"product_name":145,"url":146,"description":147},"crowdstrike","CrowdStrike","\u002Fvendor-logos\u002Fcrowdstrike.png","falcon-adversary-intelligence","Falcon Adversary Intelligence","https:\u002F\u002Fwww.crowdstrike.com\u002Fen-us\u002Fplatform\u002Fthreat-intelligence\u002F","Threat intelligence on the adversaries CrowdStrike tracks, built into the Falcon platform to detect, disrupt and defend against them.",[149],{"slug":150,"name":21,"logo_path":151,"roles":152},"ivanti","\u002Fvendor-logos\u002Fivanti.png",[153],"affected",{"slug":155,"title":156,"body":157,"framework_refs":158,"framework_notes":166},"ivanti-zero-day-chain-exploited-before-patches-available","Ivanti Zero-Day Chain Exploited Before Patches Available","Threat actor UTA0576 chained multiple zero-day vulnerabilities in Ivanti Connect Secure to achieve root-level access, steal credentials, and exfiltrate sensitive data — all before patches were available. This incident highlights the extreme risk posed by internet-facing VPN appliances, which are high-value targets precisely because they sit at the perimeter and often run with elevated privileges. The chaining of vulnerabilities demonstrates how attackers can escalate impact dramatically when multiple unpatched flaws exist in the same product. CISA's addition of these CVEs to the Known Exploited Vulnerabilities catalog underscores the urgency of treating VPN infrastructure as critical attack surface requiring near-real-time monitoring and rapid response.",[159,160,161,162,163,164,165],"CIS Control 7: Continuous Vulnerability Management","NIST SP 800-53 SI-2: Flaw Remediation","ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities","OWASP A06:2021 Vulnerable and Outdated Components","NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control","NIS2 Article 21(2)(b)","MITRE ATT&CK T1566: Phishing",{"NIS2 Article 21(2)(b)":167,"MITRE ATT&CK T1566: Phishing":168,"NIST SP 800-53 SI-2: Flaw Remediation":169,"OWASP A06:2021 Vulnerable and Outdated Components":170,"CIS Control 7: Continuous Vulnerability Management":171,"ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities":172,"NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control":173},"NIS2 mandates incident handling and vulnerability management practices for critical infrastructure operators; these requirements would have compelled affected organisations to patch internet-facing VPN devices as a priority security measure.","While the initial vector here was vulnerability exploitation rather than phishing, the subsequent credential theft (a common post-exploitation goal) aligns with ATT&CK credential access techniques, reinforcing the need to monitor for lateral movement and data exfiltration following initial compromise of edge devices.","SI-2 requires organisations to identify, report, and correct information system flaws on defined timescales — a formal flaw remediation process would have mandated urgent patching of these VPN zero-days as soon as vendor guidance was issued.","The attack exploited unpatched components in a widely deployed VPN product, directly matching this risk category, which calls for tracking and rapidly updating known-vulnerable software components.","Continuous vulnerability scanning of internet-facing assets like Ivanti Connect Secure would have flagged the unpatched flaws and triggered remediation workflows before exploitation occurred.","This control requires timely identification and remediation of technical vulnerabilities in systems; adherence would have ensured Ivanti appliances were patched or compensating controls applied upon disclosure.","The attackers leveraged root privilege escalation and credential theft; stronger access controls and privileged access management on VPN infrastructure would have limited the blast radius of the exploit chain."]