Hackers exploit Ivanti Connect Secure zero-days to gain root access and steal credentials
ZERO-DAYIvanti Connect Secureredteam/daily · 1 source
- Severity
- Critical
- Sources
- 1
What happened
A chain of zero-day vulnerabilities in Ivanti Connect Secure VPN appliances allowed attackers to execute commands with root privileges, steal credentials and probe internal networks. Volexity has tracked the unknown actor as UTA0576 and says the exploitation dates back to 3 October 2026, against an appliance that was fully patched at the time.
For IT people · Written by AI from 1 source · Wrong?
What to do
- Check whether your organisation runs Ivanti Connect Secure VPN appliances.
- Review Ivanti Connect Secure appliances for signs of compromise and reset any credentials they may have exposed.
Written by AI from the sources, checked against them
Full story timeline · 1 update
Who reported · 1 outlet
GBHackers
Who and what is in it
Products