[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fUzWsKTXz3YvY66GNEL0x4SMjWST_ezn7kS2GoRNk240":3},{"lesson":4},{"id":5,"slug":6,"article_id":7,"title":8,"body":9,"prevention":10,"framework_refs":11,"framework_notes":23,"status":24,"created_at":25,"published_at":26,"article":27,"tags":31,"podcasts":50,"controls":51},"abb3f661-4d0d-49fe-a3ef-dc85d6ed5fda","ivanti-zero-day-exploited-for-root-level-access-patch-immediately","9970a271-dc90-4fe5-ac1e-7d682889b269","Ivanti Zero-Day Exploited for Root-Level Access — Patch Immediately","A critical authentication bypass vulnerability (CVE-2026-104935) in Ivanti Connect Secure is being actively exploited as a zero-day by threat actor UTA0576, who chains it with additional flaws to achieve unauthenticated root-level code execution. The attack has been ongoing since at least October 1st, giving adversaries significant dwell time to harvest Active Directory credentials and exfiltrate sensitive data before defenders were alerted. This incident underscores the danger of unpatched internet-facing VPN and remote access appliances, which serve as high-value entry points into enterprise networks. CISA's emergency directive to federal agencies reflects the severity of the risk, and all organizations — public and private — should treat this as a critical, time-sensitive threat.","**Immediate Actions:**\n- Apply Ivanti's latest patch or upgrade immediately, prioritizing internet-facing ICS systems.\n- Audit all Ivanti Connect Secure instances for indicators of compromise (IoCs) dating back to at least October 1st.\n- Temporarily restrict or isolate ICS systems from the internet if patching cannot be completed within 24 hours.\n\n**Detection Measures:**\n- Review authentication and access logs on ICS appliances for anomalous or unauthenticated access attempts.\n- Deploy threat intelligence feeds containing UTA0576 IoCs into your SIEM for active alerting.\n- Conduct a credential reset for any Active Directory accounts accessible through the compromised VPN infrastructure.\n\n**Long-Term Improvements:**\n- Establish an emergency patching SLA (e.g., 24–48 hours) for critical vulnerabilities on internet-facing systems.\n- Implement network segmentation to limit lateral movement from VPN appliances into core Active Directory and sensitive data environments.\n- Maintain a continuously updated inventory of all network appliances and their patch status using an automated vulnerability management platform.",[12,13,14,15,16,17,18,19,20,21,22],"CIS Control 7: Continuous Vulnerability Management","CIS Control 12: Network Infrastructure Management","CIS Control 13: Network Monitoring and Defense","NIST SP 800-40 Rev. 4: Guide to Enterprise Patch Management","NIST SI-2: Flaw Remediation","NIST AC-17: Remote Access","NIST IR-4: Incident Handling","NIST SC-7: Boundary Protection (Network Segmentation)","CISA BOD 22-01: Reducing the Significant Risk of Known Exploited Vulnerabilities","ITIL: Problem Management \u002F Change Management (Emergency Change)","GDPR Article 32: Security of Processing (breach risk from credential exposure)",{},"published","2026-10-14T14:21:38.021642+00:00","2026-10-14T14:21:38.001+00:00",{"id":7,"url":28,"slug":29,"title":30},"https:\u002F\u002Fwww.bleepingcomputer.com\u002Fnews\u002Fsecurity\u002Fcisa-warns-admins-to-immediately-fix-ivanti-flaw-exploited-as-zero-day\u002F","cisa-warns-admins-to-immediately-fix-ivanti-flaw-exploited-as-zero-day-e05ffd","CISA warns admins to immediately fix Ivanti flaw exploited as zero-day",[32,38,44],{"id":33,"name":34,"slug":35,"description":36,"color":37},"05757c8d-6b93-4194-b35d-7359e7d33b0e","Vulnerability Management","vulnerability-management","Missing scans, no risk prioritization","#fb923c",{"id":39,"name":40,"slug":41,"description":42,"color":43},"182e11d5-57c4-444e-8ec8-4682ad60261b","Incident Response","incident-response","Slow detection, poor containment, missing playbooks","#14b8a6",{"id":45,"name":46,"slug":47,"description":48,"color":49},"af7fce9e-1ce8-4156-93bc-09dcfbfdf29d","Patch Management","patch-management","Unpatched vulnerabilities, delayed updates","#ef4444",[],[52,56,59],{"slug":53,"name":54,"problem":55},"identity-threat-detection","Identity threat detection and response (ITDR)","Attackers who log in with real, stolen credentials get noticed.",{"slug":35,"name":57,"problem":58},"Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",{"slug":47,"name":60,"problem":61},"Automated patch management","Known holes get closed in days, not months."]