[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fz59S_-rx5R4VMVZ6n51jNn8jCI02dK07xaNGB-83dYw":3},{"lesson":4},{"id":5,"slug":6,"article_id":7,"title":8,"body":9,"prevention":10,"framework_refs":11,"framework_notes":23,"status":24,"created_at":25,"published_at":26,"article":27,"tags":31,"podcasts":50,"controls":51},"5218aa67-fd33-4253-9798-ff2d059a8c35","chained-zero-days-in-ivanti-vpn-grant-attackers-root-access","1e562546-8ba4-4e9b-b4a3-5c6eddf52fd9","Chained Zero-Days in Ivanti VPN Grant Attackers Root Access","Threat actor UTA0576 exploited three chained zero-day vulnerabilities in Ivanti Connect Secure VPN appliances, achieving unauthenticated root-level command execution — one of the most severe possible outcomes for an internet-facing device. The attack chain demonstrates how unpatched, perimeter-facing appliances can serve as a direct gateway to internal networks and credential stores. With one of the three flaws still unpatched, organizations remain exposed even after applying available fixes. This incident highlights how VPN gateways, trusted precisely because they control access, become high-value targets that demand accelerated patch cycles and compensating controls when patches are unavailable.","**Immediate actions:**\n- Apply Ivanti's available patches for the two disclosed CVEs immediately and monitor vendor channels for the third patch release.\n- Temporarily isolate or restrict external access to Ivanti Connect Secure appliances until all three vulnerabilities are fully remediated.\n- Audit VPN logs and credential stores for signs of unauthorized access, credential theft, or password spraying activity linked to UTA0576 TTPs.\n\n**Long-term improvements:**\n- Establish an emergency patching SLA (e.g., 24–72 hours) specifically for critical, internet-facing infrastructure such as VPN gateways and firewalls.\n- Maintain a continuously updated inventory of all network appliances and their firmware\u002Fsoftware versions to accelerate vulnerability impact assessment.\n- Implement zero-trust network access (ZTNA) principles to reduce reliance on perimeter VPN appliances as the sole access control boundary.\n\n**Detection measures:**\n- Deploy integrity monitoring and file-system anomaly detection on VPN appliances to catch exploitation attempts that bypass traditional authentication logging.\n- Integrate threat intelligence feeds (e.g., Volexity, CISA KEV) into your SIEM to receive early warning of active exploitation against your vendor stack.\n- Enable network segmentation so that a compromised VPN appliance cannot directly pivot to sensitive internal systems or credential infrastructure.",[12,13,14,15,16,17,18,19,20,21,22],"CIS Control 7: Continuous Vulnerability Management","CIS Control 12: Network Infrastructure Management","CIS Control 13: Network Monitoring and Defense","NIST SP 800-40 Rev. 4: Guide to Enterprise Patch Management","NIST SI-2: Flaw Remediation","NIST SC-7: Boundary Protection","NIST IR-4: Incident Handling","CISA Known Exploited Vulnerabilities (KEV) Catalog","NIST AC-17: Remote Access","ISO\u002FIEC 27001: A.12.6.1 Management of Technical Vulnerabilities","ITIL: Problem Management \u002F Emergency Change Advisory Board (eCAB)",{},"published","2026-10-13T20:21:49.063727+00:00","2026-10-13T20:21:49.043+00:00",{"id":7,"url":28,"slug":29,"title":30},"https:\u002F\u002Fthehackernews.com\u002F2026\u002F10\u002Fattacker-chains-three-ivanti-connect.html","attacker-chains-three-ivanti-connect-secure-zero-days-for-root-access-only-two-p-ea27b5","Attacker Chains Three Ivanti Connect Secure Zero-Days for Root Access, Only Two Patched So Far",[32,38,44],{"id":33,"name":34,"slug":35,"description":36,"color":37},"05757c8d-6b93-4194-b35d-7359e7d33b0e","Vulnerability Management","vulnerability-management","Missing scans, no risk prioritization","#fb923c",{"id":39,"name":40,"slug":41,"description":42,"color":43},"af7fce9e-1ce8-4156-93bc-09dcfbfdf29d","Patch Management","patch-management","Unpatched vulnerabilities, delayed updates","#ef4444",{"id":45,"name":46,"slug":47,"description":48,"color":49},"f43a7f30-5046-4b10-9dba-1a704139821e","Network Segmentation","network-segmentation","Lateral movement, flat networks, missing firewalls","#06b6d4",[],[52,55,58],{"slug":35,"name":53,"problem":54},"Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",{"slug":41,"name":56,"problem":57},"Automated patch management","Known holes get closed in days, not months.",{"slug":59,"name":60,"problem":61},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped."]