Hackers exploit Ivanti Connect Secure zero-days to gain root access and steal credentials
ZERO-DAYIvanti Connect Secureredteam/daily · 1 source
- Severity
- Critical
- Sources
- 1
What happened
A zero-day chain in Ivanti Connect Secure (ICS) VPN appliances enabled root-level command execution, credential theft and internal network reconnaissance. Volexity attributes the activity to UTA0576 and traces exploitation to 3 October 2026, against an appliance that was fully patched at the time, which suggests the chain bypassed the vendor's fixes. The article gives no CVE identifiers or fixed versions. Defenders should check whether they run ICS appliances, review them for signs of compromise and monitor the vendor and Volexity for advisories and indicators.
For security analysts · Written by AI from 1 source · Wrong?
What to do
- Check whether your organisation runs Ivanti Connect Secure VPN appliances.
- Review Ivanti Connect Secure appliances for signs of compromise and reset any credentials they may have exposed.
Written by AI from the sources, checked against them
Full story timeline · 1 update
Who reported · 1 outlet
GBHackers
Who and what is in it
Products