Ivanti Connect Secure Exploit Chain: Patching Alone Will Not Save You
What happened
Attackers have been chaining three vulnerabilities — CVE-2026-104935, CVE-2026-111357, and CVE-2026-118527 — to compromise Ivanti Connect Secure VPN appliances from the internet, ending with full root control of the device. The activity has been attributed to a threat cluster tracked as UTA0576.
Why it matters
VPN appliances are the front door to the corporate network. They are, by design, exposed to the internet and trusted to let people in. When the front door itself is compromised, the attacker is already inside — and they often have visibility into credentials and sessions passing through the device.
The critical warning from responders: patching alone is not enough if you were already breached. A patch closes the hole, but it does not evict an attacker who already planted persistence or stole credentials before you patched.
The full-compromise playbook
1. Chain the three CVEs to go from unauthenticated internet access to root on the appliance.
2. Harvest credentials and session material flowing through the VPN.
3. Establish persistence that can survive a simple patch.
How to defend
- Patch now to the fixed Ivanti releases — this is step one, not the whole job.
- Assume breach on any appliance that was exposed and unpatched during the exploitation window. That means:
- Review logs for signs of lateral movement from the appliance into the internal network.
- Factory reset the appliance to clear potential implants.
- Rotate every credential that touched the device — admin accounts, service accounts, and any user credentials that may have been captured.
- Revoke and reissue certificates and VPN session secrets.
What it means for you
This incident is a perfect case study in incident response: the fix (patch) and the recovery (reset + rotate) are two different activities. If you are studying network security, remember that "we applied the update" is not the same as "we are no longer compromised."