Ivanti Zero-Day Exploited for Root-Level Access — Patch Immediately
A critical authentication bypass vulnerability (CVE-2026-104935) in Ivanti Connect Secure is being actively exploited as a zero-day by threat actor UTA0576, who chains it with additional flaws to achieve unauthenticated root-level code execution. The attack has been ongoing since at least October 1st, giving adversaries significant dwell time to harvest Active Directory credentials and exfiltrate sensitive data before defenders were alerted. This incident underscores the danger of unpatched internet-facing VPN and remote access appliances, which serve as high-value entry points into enterprise networks. CISA's emergency directive to federal agencies reflects the severity of the risk, and all organizations — public and private — should treat this as a critical, time-sensitive threat.
Tactical Insight
Immediate Actions
- Apply Ivanti's latest patch or upgrade immediately, prioritizing internet-facing ICS systems.
- Audit all Ivanti Connect Secure instances for indicators of compromise (IoCs) dating back to at least October 1st.
- Temporarily restrict or isolate ICS systems from the internet if patching cannot be completed within 24 hours.
Detection Measures
- Review authentication and access logs on ICS appliances for anomalous or unauthenticated access attempts.
- Deploy threat intelligence feeds containing UTA0576 IoCs into your SIEM for active alerting.
- Conduct a credential reset for any Active Directory accounts accessible through the compromised VPN infrastructure.
Long-Term Improvements
- Establish an emergency patching SLA (e.g., 24–48 hours) for critical vulnerabilities on internet-facing systems.
- Implement network segmentation to limit lateral movement from VPN appliances into core Active Directory and sensitive data environments.
- Maintain a continuously updated inventory of all network appliances and their patch status using an automated vulnerability management platform.