[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$f0stiHAg94RcRUQzj9d1VFm1I8CnQ6OdrijekCIGJdzQ":3},{"lesson":4},{"id":5,"slug":6,"article_id":7,"title":8,"body":9,"prevention":10,"framework_refs":11,"framework_notes":22,"status":23,"created_at":24,"published_at":25,"article":26,"tags":30,"podcasts":49,"controls":56},"d96c5781-405c-4bc0-8f23-f3e97a9e3785","ivanti-connect-secure-zero-day-exploited-in-the-wild","eb99244b-2cd8-4447-898e-3f4db4e7cee4","Ivanti Connect Secure Zero-Day Exploited in the Wild","A critical authentication bypass vulnerability in Ivanti Connect Secure (CVE-2026-104935) allows unauthenticated attackers to execute arbitrary commands without requiring any credentials, representing one of the most severe risk profiles possible for an internet-facing gateway. The root cause lies in a failure of authentication enforcement logic, meaning the access control boundary that should protect the device can be entirely circumvented. Because Connect Secure is a remote access gateway, exploitation can serve as an entry point to the broader corporate network, amplifying the blast radius significantly. Zero-day vulnerabilities like this underscore the danger of delaying patch cycles, particularly for perimeter-facing devices that are directly reachable from the internet.","**Immediate actions:**\n- Apply Ivanti's emergency patch or mitigation guidance for CVE-2026-104935 to all affected Connect Secure instances without delay.\n- Restrict internet-facing access to the Ivanti admin interface using IP allowlists or jump hosts while patching is underway.\n- Audit authentication and command-execution logs on all Connect Secure appliances for signs of exploitation or anomalous activity.\n\n**Long-term improvements:**\n- Maintain a continuously updated inventory of all internet-facing network appliances, including firmware and software versions, to enable rapid patch prioritization.\n- Establish a formal emergency patching procedure with defined SLAs (e.g., 24–48 hours) for critical, actively exploited vulnerabilities on perimeter devices.\n- Implement network segmentation to ensure remote access gateways cannot directly reach sensitive internal segments without additional authentication controls.\n\n**Detection measures:**\n- Deploy network-based anomaly detection and SIEM alerting specifically tuned to unusual command execution or unauthenticated session activity on VPN gateways.\n- Subscribe to vendor security advisories and threat intelligence feeds (e.g., CISA KEV catalog) to receive real-time notification of active exploitation.\n- Conduct regular vulnerability scans targeting internet-exposed assets and validate patch compliance through authenticated scanning.",[12,13,14,15,16,17,18,19,20,21],"CIS Control 7: Continuous Vulnerability Management","CIS Control 12: Network Infrastructure Management","CIS Control 4: Secure Configuration of Enterprise Assets","NIST SP 800-40 Rev. 4: Guide to Enterprise Patch Management","NIST SI-2: Flaw Remediation","NIST AC-17: Remote Access","NIST RA-5: Vulnerability Monitoring and Scanning","CISA KEV (Known Exploited Vulnerabilities) Catalog","ISO\u002FIEC 27001:2022 Annex A 8.8: Management of Technical Vulnerabilities","ITIL 4: Change Enablement \u002F Emergency Change process",{},"published","2026-10-13T16:20:32.118347+00:00","2026-10-13T16:20:32.077+00:00",{"id":7,"url":27,"slug":28,"title":29},"https:\u002F\u002Fwww.bleepingcomputer.com\u002Fnews\u002Fsecurity\u002Fivanti-warns-of-connect-secure-zero-day-exploited-in-attacks\u002F","ivanti-warns-of-connect-secure-zero-day-exploited-in-attacks-0dfe31","Ivanti warns of Connect Secure zero-day exploited in attacks",[31,37,43],{"id":32,"name":33,"slug":34,"description":35,"color":36},"05757c8d-6b93-4194-b35d-7359e7d33b0e","Vulnerability Management","vulnerability-management","Missing scans, no risk prioritization","#fb923c",{"id":38,"name":39,"slug":40,"description":41,"color":42},"1ec88fde-2d0f-4ed8-932a-33f5ccc0fdc7","Access Control","access-control","Excessive privileges, missing MFA, weak auth","#f97316",{"id":44,"name":45,"slug":46,"description":47,"color":48},"af7fce9e-1ce8-4156-93bc-09dcfbfdf29d","Patch Management","patch-management","Unpatched vulnerabilities, delayed updates","#ef4444",[50],{"id":51,"date":52,"edition":53,"title":54,"audio_url":55},"24f41b17-3534-43de-b09e-297a5be760d7","2026-10-14","morning","ThreatNoir Morning Brief — October 14","https:\u002F\u002Fcdn.threatnoir.com\u002Fpodcasts\u002F2026-10-14\u002Fthreatnoir-morning-brief-2026-10-14.mp3",[57,61,64],{"slug":58,"name":59,"problem":60},"zero-trust-access","Zero trust network access (ZTNA)","Remote access no longer means exposing VPN appliances to the internet.",{"slug":34,"name":62,"problem":63},"Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",{"slug":46,"name":65,"problem":66},"Automated patch management","Known holes get closed in days, not months."]