Act
active
Ivanti Connect Secure zero-day actively exploited in the wild
- Engineer — Act: Ivanti Connect Secure is a common enterprise VPN gateway with a history of nation-state targeting; active exploitation with a vendor-issued patch means patch immediately per Ivanti’s advisory and audit appliance logs for signs of pre-patch compromise.
- SOC/IR — Act: Active exploitation of an edge VPN appliance warrants an assume-breach sweep: hunt for unauthorized sessions, anomalous authentication events, or lateral movement originating from ICS gateway IPs since the vulnerability’s disclosure window.
- Leader — Act: A zero-day in a widely-deployed remote access gateway being actively exploited is a board-question-level event; confirm this week whether ICS is in your environment, verify patching is under way, and assess whether any compromise could trigger SEC or GDPR notification obligations.
This entry was curated and judged by AI (Claude) with automated enrichment
(CISA KEV / EPSS / public PoC). Verify against the original source before
acting. Found a bad verdict?
Report it —
confirmed errors go to the corrections log.