[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fAI0x6mmBACsWTKVhrD-pJzo0EQe2E0-6aH5vvEQ53Ic":3},{"lesson":4},{"id":5,"slug":6,"article_id":7,"title":8,"body":9,"prevention":10,"framework_refs":11,"framework_notes":19,"status":27,"created_at":28,"published_at":29,"article":30,"tags":34,"podcasts":47,"controls":48},"d0cb8ff0-8f10-4e12-abb8-1aae2d1f0385","chained-ivanti-zero-days-enable-unauthenticated-root-access-and-credential-theft","90e5e3dc-5c0a-409e-9fcb-bf80399c3429","Chained Ivanti Zero-Days Enable Unauthenticated Root Access and Credential Theft","Two new zero-day vulnerabilities in Ivanti Connect Secure VPN (CVE-2026-111357 and CVE-2026-118527) were actively exploited in the wild before patches were available, and when chained with a prior flaw, they allowed attackers unauthenticated root access to sensitive credential stores including Active Directory passwords and BitLocker keys. This incident highlights the severe risk posed by internet-facing VPN appliances, which sit at the perimeter of enterprise networks and are high-value targets for nation-state and criminal actors alike. The fact that exploitation occurred before patching was possible underscores the need for compensating controls — such as network segmentation and enhanced monitoring — that can limit blast radius when zero-days cannot be immediately remediated. CISA's addition of these CVEs to the Known Exploited Vulnerabilities catalog signals that organizations without mature vulnerability management programs face significant regulatory and operational risk.","**Immediate actions:**\n- Apply Ivanti's patches or mitigations as soon as they are released and verify integrity of the VPN appliance for signs of prior compromise.\n- Rotate all credentials that may have been accessible through the VPN appliance, including Active Directory service accounts and BitLocker recovery keys.\n- Restrict internet-facing access to the Ivanti Connect Secure management interface using allowlisted IP ranges or an out-of-band management network.\n\n**Detection measures:**\n- Deploy continuous monitoring and anomaly detection on VPN appliance logs, alerting on unexpected authentication events or configuration changes.\n- Hunt for indicators of compromise associated with these CVEs using CISA's published guidance and threat intelligence feeds.\n\n**Long-term improvements:**\n- Implement strict network segmentation so that a compromised VPN appliance cannot directly reach Active Directory or sensitive credential stores.\n- Establish a formal emergency patching SLA (e.g., 24–48 hours) for critical internet-facing infrastructure when CISA KEV entries are published.\n- Maintain a continuously updated inventory of all network appliances and their patch status to enable rapid response to future zero-day disclosures.",[12,13,14,15,16,17,18],"CIS Control 7: Continuous Vulnerability Management","NIST SP 800-53 SI-2: Flaw Remediation","ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities","NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control","NIS2 Article 21(2)(b)","OWASP A06:2021 Vulnerable and Outdated Components","MITRE ATT&CK T1566: Phishing",{"NIS2 Article 21(2)(b)":20,"MITRE ATT&CK T1566: Phishing":21,"NIST SP 800-53 SI-2: Flaw Remediation":22,"OWASP A06:2021 Vulnerable and Outdated Components":23,"CIS Control 7: Continuous Vulnerability Management":24,"ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities":25,"NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control":26},"NIS2 requires essential and important entities to implement incident handling and vulnerability management measures; the active exploitation of these Ivanti flaws represents exactly the scenario NIS2 obligations are designed to prepare organizations to detect and contain.","While the initial access vector here is vulnerability exploitation rather than phishing, the subsequent credential theft (Active Directory passwords, BitLocker keys) maps to ATT&CK credential access techniques, and understanding the full attack chain via ATT&CK enables defenders to build detection logic for each stage of the compromise.","SI-2 requires organizations to identify, report, and correct information system flaws and to apply security patches within organizationally defined timeframes — a process that, if applied to Ivanti appliances, would have driven rapid mitigation even before full patches were available.","Ivanti Connect Secure is a third-party network component, and its unpatched state with known exploitable flaws is a textbook example of the risk OWASP A06 warns against — organizations must track the vulnerability status of all components, including appliances, not just application code.","A mature vulnerability management program with continuous scanning of internet-facing assets would have flagged these CVEs for prioritized remediation immediately upon disclosure and ensured compensating controls were in place while patches were pending.","This control mandates timely identification and remediation of technical vulnerabilities in information systems, directly addressing the need to track and respond to zero-day disclosures in critical perimeter devices like VPN gateways.","The chained exploit achieved unauthenticated root access, meaning strong identity and access controls — such as multi-factor authentication and least-privilege architecture — could have raised the bar for attackers even on an unpatched system.","published","2026-11-02T13:22:28.674444+00:00","2026-11-02T13:22:28.658+00:00",{"id":7,"url":31,"slug":32,"title":33},"https:\u002F\u002Fwww.rapid7.com\u002Fblog\u002Fpost\u002Fetr-additional-ivanti-connect-secure-zero-days-exploited-in-the-wild-cve-2026-111357-cve-2026-118527","additional-ivanti-connect-secure-zero-days-exploited-in-the-wild-cve-2026-111357-0d7380","Additional Ivanti Connect Secure zero-days exploited in the wild (CVE-2026-111357, CVE-2026-118527)",[35,41],{"id":36,"name":37,"slug":38,"description":39,"color":40},"05757c8d-6b93-4194-b35d-7359e7d33b0e","Vulnerability Management","vulnerability-management","Missing scans, no risk prioritization","#fb923c",{"id":42,"name":43,"slug":44,"description":45,"color":46},"af7fce9e-1ce8-4156-93bc-09dcfbfdf29d","Patch Management","patch-management","Unpatched vulnerabilities, delayed updates","#ef4444",[],[49,53,56],{"slug":50,"name":51,"problem":52},"privileged-access-management","Privileged access management (PAM)","Admin accounts stop being one stolen password away from control of everything.",{"slug":38,"name":54,"problem":55},"Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",{"slug":44,"name":57,"problem":58},"Automated patch management","Known holes get closed in days, not months."]