[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fDMn6T3szP-x7FkmrTeTCOT_RF49J87gdfQzYzFUuZ7U":3},{"article":4,"iocs":54,"watch_terms":59,"solutions":60,"lesson":151},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":31,"category":32,"article_tags":36},"085c7252-db9a-4a6f-9557-6582c3971131","Ivanti Zero-Day Chain Gave Attackers Root Access to Fully Patched VPN","ivanti-zero-day-chain-gave-attackers-root-access-to-fully-patched-vpn-a59a9a","CVE-2026-104935 affects Ivanti Connect Secure and it can be exploited for unauthenticated remote code execution with elevated privileges. The post Ivanti Zero-Day Chain Gave Attackers Root Access to Fully Patched VPN appeared first on SecurityWeek.","Ivanti has issued a warning about a zero-day vulnerability, CVE-2026-104935, affecting its Connect Secure VPN appliances. Exploited in the wild by a threat actor named UTA0576, the vulnerability chain allows unauthenticated attackers to gain root-level code execution. The attackers focused on credential theft, data exfiltration, and reconnaissance, potentially preparing for lateral movement within victim networks.","Ivanti VPN zero-day chain exploited for root access; credential theft and data exfiltration observed.","https:\u002F\u002Fwww.securityweek.com\u002Fivanti-zero-day-chain-gave-attackers-root-access-to-fully-patched-vpn\u002F","https:\u002F\u002Fwww.securityweek.com\u002Fwp-content\u002Fuploads\u002F2024\u002F02\u002FIvanti-Risks-Exploits.jpg","2026-10-13T18:43:43+00:00","2026-10-13T20:00:23.062026+00:00",9,[17,20,23,26,29],{"name":18,"type":19},"Connect Secure","product",{"name":21,"type":22},"Ivanti","vendor",{"name":24,"type":25},"UTA0576","threat_actor",{"name":27,"type":28},"VPN","technology",{"name":30,"type":28},"Active Directory","80544778-fabb-4dcd-aa35-17492e5dcf4f",{"id":31,"icon":33,"name":34,"slug":35},null,"Vulnerabilities","vulnerabilities",[37,42,47,49],{"category":38},{"id":39,"icon":33,"name":40,"slug":41},"574f766a-fb3f-487c-8d2c-0720ae75471b","Zero-day","zero-day",{"category":43},{"id":44,"icon":33,"name":45,"slug":46},"6cbdd207-aaa1-4176-9534-e156b125e917","Nation-state","nation-state",{"category":48},{"id":31,"icon":33,"name":34,"slug":35},{"category":50},{"id":51,"icon":33,"name":52,"slug":53},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[55],{"type":56,"value":57,"context":58},"cve","CVE-2026-104935","Zero-day vulnerability in Ivanti Connect Secure exploited for authentication bypass and RCE.",[21,18],{"controls":61,"vendors":147},[62,91,120],{"slug":63,"name":64,"problem":65,"products":66},"identity-threat-detection","Identity threat detection and response (ITDR)","Attackers who log in with real, stolen credentials get noticed.",[67,75,83],{"vendor_slug":68,"vendor_name":69,"vendor_logo":70,"product_slug":71,"product_name":72,"url":73,"description":74},"okta","Okta","\u002Fvendor-logos\u002Fokta.png","identity-threat-protection","Okta Identity Threat Protection","https:\u002F\u002Fwww.okta.com\u002Fproducts\u002Fidentity-threat-protection\u002F","Continuous risk assessment of sessions after login, with automatic actions such as ending sessions.",{"vendor_slug":76,"vendor_name":77,"vendor_logo":78,"product_slug":79,"product_name":80,"url":81,"description":82},"crowdstrike","CrowdStrike","\u002Fvendor-logos\u002Fcrowdstrike.png","falcon-identity-protection","Falcon Identity Protection","https:\u002F\u002Fwww.crowdstrike.com\u002Fen-us\u002Fplatform\u002Fnext-gen-identity-security\u002Fidentity-protection\u002F","Detection of identity attacks against Active Directory and Entra ID, with risk-based MFA.",{"vendor_slug":84,"vendor_name":85,"vendor_logo":86,"product_slug":87,"product_name":88,"url":89,"description":90},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","defender-for-identity","Microsoft Defender for Identity","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fsiem-and-xdr\u002Fmicrosoft-defender-for-identity","Detects attacks against on-premises Active Directory and hybrid identities.",{"slug":92,"name":93,"problem":94,"products":95},"zero-trust-access","Zero trust network access (ZTNA)","Remote access no longer means exposing VPN appliances to the internet.",[96,104,112],{"vendor_slug":97,"vendor_name":98,"vendor_logo":99,"product_slug":100,"product_name":101,"url":102,"description":103},"zscaler","Zscaler","\u002Fvendor-logos\u002Fzscaler.png","zscaler-private-access","Zscaler Private Access","https:\u002F\u002Fwww.zscaler.com\u002Fproducts-and-solutions\u002Fzscaler-private-access","Zero trust access to private applications, replacing VPN.",{"vendor_slug":105,"vendor_name":106,"vendor_logo":107,"product_slug":108,"product_name":109,"url":110,"description":111},"cloudflare","Cloudflare","\u002Fvendor-logos\u002Fcloudflare.png","cloudflare-access","Cloudflare Access","https:\u002F\u002Fwww.cloudflare.com\u002Fsase\u002Fproducts\u002Faccess\u002F","Zero trust access to internal applications without a VPN.",{"vendor_slug":113,"vendor_name":114,"vendor_logo":115,"product_slug":116,"product_name":117,"url":118,"description":119},"palo-alto-networks","Palo Alto Networks","\u002Fvendor-logos\u002Fpalo-alto-networks.png","prisma-access","Prisma Access","https:\u002F\u002Fwww.paloaltonetworks.com\u002Fsase\u002Faccess","Cloud-delivered SASE: zero trust access to private apps and secure web gateway.",{"slug":121,"name":122,"problem":123,"products":124},"patch-management","Automated patch management","Known holes get closed in days, not months.",[125,132,140],{"vendor_slug":126,"vendor_name":21,"vendor_logo":127,"product_slug":128,"product_name":129,"url":130,"description":131},"ivanti","\u002Fvendor-logos\u002Fivanti.png","neurons-patch-management","Ivanti Neurons for Patch Management","https:\u002F\u002Fwww.ivanti.com\u002Fproducts\u002Fivanti-neurons-for-patch-management","Risk-based patch management for operating systems and third-party applications.",{"vendor_slug":133,"vendor_name":134,"vendor_logo":135,"product_slug":136,"product_name":137,"url":138,"description":139},"ninjaone","NinjaOne","\u002Fvendor-logos\u002Fninjaone.png","ninjaone-patch-management","NinjaOne Patch Management","https:\u002F\u002Fwww.ninjaone.com\u002Fpatch-management\u002F","Automated patching of operating systems and third-party applications from the cloud.",{"vendor_slug":141,"vendor_name":142,"vendor_logo":143,"product_slug":121,"product_name":144,"url":145,"description":146},"qualys","Qualys","\u002Fvendor-logos\u002Fqualys.png","Qualys Patch Management","https:\u002F\u002Fwww.qualys.com\u002Fapps\u002Fpatch-management\u002F","Patch deployment for operating systems and third-party applications, linked to vulnerability findings.",[148],{"slug":126,"name":21,"logo_path":127,"roles":149},[150],"affected",{"slug":152,"title":153,"body":154,"framework_refs":155,"framework_notes":169},"ivanti-zero-day-grants-root-access-to-fully-patched-vpn-appliances","Ivanti Zero-Day Grants Root Access to Fully Patched VPN Appliances","A chained zero-day vulnerability in Ivanti Connect Secure VPN allowed unauthenticated attackers to achieve root-level code execution even on fully patched systems, demonstrating that patch compliance alone is insufficient against novel exploit chains. The threat actor UTA0576 weaponized CVE-2026-104935 to conduct credential theft, data exfiltration, and reconnaissance — classic precursors to deeper network compromise. This incident highlights the critical danger of exposing VPN appliances directly to the internet without compensating controls. Because the devices were already patched, defenders had limited traditional recourse, underscoring the need for behavioral detection, network segmentation, and rapid incident response capabilities around perimeter infrastructure.",[156,157,158,159,160,161,162,163,164,165,166,167,168],"CIS Control 7: Continuous Vulnerability Management","CIS Control 12: Network Infrastructure Management","CIS Control 13: Network Monitoring and Defense","NIST SP 800-53 SI-2: Flaw Remediation","NIST SP 800-53 AC-17: Remote Access","NIST SP 800-53 SC-7: Boundary Protection","NIST SP 800-53 IR-4: Incident Handling","NIST CSF DE.CM-1: Network Monitoring","NIST CSF RS.RP-1: Response Planning","MITRE ATT&CK T1190: Exploit Public-Facing Application","MITRE ATT&CK T1078: Valid Accounts (credential theft follow-on)","ISO\u002FIEC 27001 A.12.6.1: Management of Technical Vulnerabilities","ITIL: Change and Release Management for Emergency Patches",{}]