[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fiX7A4GlN25u0kt_LDDOjUHuZuTM5lr0S56vqoJGqKY8":3},{"lesson":4},{"id":5,"slug":6,"article_id":7,"title":8,"body":9,"prevention":10,"framework_refs":11,"framework_notes":19,"status":27,"created_at":28,"published_at":29,"article":30,"tags":34,"podcasts":47,"controls":48},"94dcf469-ee12-411d-9aee-fe0541b4e238","ivanti-connect-secure-zero-days-exploited-to-steal-credentials-and-access-federal-networks","cee019c6-f9a6-4679-9c49-6c2580ff2833","Ivanti Connect Secure Zero-Days Exploited to Steal Credentials and Access Federal Networks","Three Ivanti Connect Secure vulnerabilities were actively exploited as zero-days before patches were widely applied, enabling attackers to gain network access, harvest credentials, and query sensitive data. The incident highlights the acute risk posed by internet-facing VPN and remote access appliances, which are high-value targets due to their privileged position on the network perimeter. Federal agencies' reliance on these systems without sufficient compensating controls amplified the blast radius when exploitation occurred. The CISA mandate for both patching and forensic investigation underscores that remediation alone is insufficient — organizations must also determine whether compromise already occurred.","**Immediate actions:**\n- Apply Ivanti's latest patches or mitigations for CVE-2026-111357, CVE-2026-118527, and CVE-2026-104935 across all affected instances immediately.\n- Conduct forensic triage on all Ivanti Connect Secure appliances to determine whether exploitation or credential theft has already occurred.\n- Reset all credentials and session tokens that may have transited or been stored on affected Ivanti appliances.\n\n**Long-term improvements:**\n- Maintain a complete, continuously updated inventory of all internet-facing network appliances and prioritize them in vulnerability scanning cycles.\n- Establish emergency patching SLAs (e.g., 24–72 hours) specifically for critical internet-facing infrastructure when active exploitation is confirmed.\n- Implement network segmentation so that VPN concentrators and remote access gateways cannot directly reach sensitive internal systems without additional authentication.\n\n**Detection measures:**\n- Deploy centralized logging and SIEM alerting for anomalous authentication events, unusual credential queries, and unexpected lateral movement originating from VPN gateway IP ranges.\n- Subscribe to CISA's Known Exploited Vulnerabilities (KEV) catalog feed and automate alerts when any catalogued CVE matches assets in your environment.\n- Perform regular threat-hunting exercises targeting remote access infrastructure to detect post-exploitation persistence mechanisms.",[12,13,14,15,16,17,18],"CIS Control 7: Continuous Vulnerability Management","NIST SP 800-53 SI-2: Flaw Remediation","ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities","NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control","NIS2 Article 21(2)(b)","MITRE ATT&CK T1566: Phishing","OWASP A06:2021 Vulnerable and Outdated Components",{"NIS2 Article 21(2)(b)":20,"MITRE ATT&CK T1566: Phishing":21,"NIST SP 800-53 SI-2: Flaw Remediation":22,"OWASP A06:2021 Vulnerable and Outdated Components":23,"CIS Control 7: Continuous Vulnerability Management":24,"ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities":25,"NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control":26},"NIS2 requires entities to implement incident handling measures and vulnerability management practices; the zero-day exploitation of a widely used remote access product in critical infrastructure is precisely the scenario this article is designed to address.","While initial access here was via vulnerability exploitation rather than phishing, the subsequent credential theft maps to ATT&CK credential access techniques — using ATT&CK to model adversary behavior on perimeter devices would help defenders build detection rules for post-exploitation activity on Ivanti appliances.","SI-2 requires organizations to identify, report, and correct information system flaws within organizationally defined time periods — a formal flaw remediation process with enforceable deadlines would have directly addressed the delay in patching these Ivanti vulnerabilities.","The exploitation of known, catalogued CVEs in a widely deployed commercial appliance is a textbook example of the risk posed by vulnerable and outdated components, reinforcing the need to track and update all third-party software and firmware in the environment.","Regular, prioritized vulnerability scanning and a defined remediation timeline for internet-facing appliances would have ensured these Ivanti flaws were patched before or immediately upon public disclosure, reducing the exploitation window.","This control mandates timely identification and remediation of technical vulnerabilities in information systems, including network appliances like Ivanti Connect Secure that sit at the network perimeter.","Because the attackers used these vulnerabilities to steal credentials, stronger identity protection measures — such as short-lived tokens, MFA enforcement, and rapid credential rotation — would have limited the damage of the credential theft component.","published","2026-11-02T16:20:50.966357+00:00","2026-11-02T16:20:50.941+00:00",{"id":7,"url":31,"slug":32,"title":33},"https:\u002F\u002Fwww.helpnetsecurity.com\u002F2026\u002F11\u002F02\u002Fcisa-to-federal-agencies-remediate-exploited-ivanti-connect-secure-vulnerabilities-cve-2026-111357-cve-2026-118527\u002F","cisa-to-federal-agencies-remediate-exploited-ivanti-connect-secure-vulnerabiliti-b0ce29","CISA to federal agencies: Remediate exploited Ivanti Connect Secure vulnerabilities (CVE-2026-111357, CVE-2026-118527)",[35,41],{"id":36,"name":37,"slug":38,"description":39,"color":40},"05757c8d-6b93-4194-b35d-7359e7d33b0e","Vulnerability Management","vulnerability-management","Missing scans, no risk prioritization","#fb923c",{"id":42,"name":43,"slug":44,"description":45,"color":46},"af7fce9e-1ce8-4156-93bc-09dcfbfdf29d","Patch Management","patch-management","Unpatched vulnerabilities, delayed updates","#ef4444",[],[49,53,56],{"slug":50,"name":51,"problem":52},"identity-threat-detection","Identity threat detection and response (ITDR)","Attackers who log in with real, stolen credentials get noticed.",{"slug":44,"name":54,"problem":55},"Automated patch management","Known holes get closed in days, not months.",{"slug":57,"name":58,"problem":59},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped."]