Chained Ivanti Zero-Days Enable Unauthenticated Root Access and Credential Theft
Written by AI from the linked story. Not reviewed by an editor. How this works
Two new zero-day vulnerabilities in Ivanti Connect Secure VPN (CVE-2026-111357 and CVE-2026-118527) were actively exploited in the wild before patches were available, and when chained with a prior flaw, they allowed attackers unauthenticated root access to sensitive credential stores including Active Directory passwords and BitLocker keys. This incident highlights the severe risk posed by internet-facing VPN appliances, which sit at the perimeter of enterprise networks and are high-value targets for nation-state and criminal actors alike. The fact that exploitation occurred before patching was possible underscores the need for compensating controls — such as network segmentation and enhanced monitoring — that can limit blast radius when zero-days cannot be immediately remediated. CISA's addition of these CVEs to the Known Exploited Vulnerabilities catalog signals that organizations without mature vulnerability management programs face significant regulatory and operational risk.
Tactical Insight
Immediate actions
- Apply Ivanti's patches or mitigations as soon as they are released and verify integrity of the VPN appliance for signs of prior compromise.
- Rotate all credentials that may have been accessible through the VPN appliance, including Active Directory service accounts and BitLocker recovery keys.
- Restrict internet-facing access to the Ivanti Connect Secure management interface using allowlisted IP ranges or an out-of-band management network.
Detection measures
- Deploy continuous monitoring and anomaly detection on VPN appliance logs, alerting on unexpected authentication events or configuration changes.
- Hunt for indicators of compromise associated with these CVEs using CISA's published guidance and threat intelligence feeds.
Long-term improvements
- Implement strict network segmentation so that a compromised VPN appliance cannot directly reach Active Directory or sensitive credential stores.
- Establish a formal emergency patching SLA (e.g., 24–48 hours) for critical internet-facing infrastructure when CISA KEV entries are published.
- Maintain a continuously updated inventory of all network appliances and their patch status to enable rapid response to future zero-day disclosures.