Act
active
Ivanti Connect Secure zero-days chained in active attacks, patches released
- Engineer — Act: Two chained zero-days in Ivanti Connect Secure have been actively exploited since at least October 1 — apply Ivanti’s latest ICS patches immediately and treat any unpatched gateways as potentially compromised before patching.
- SOC/IR — Act: Active exploitation dating back to October 1 means assume-breach posture for any Ivanti ICS gateways in your estate — hunt for lateral movement or persistence established through the VPN edge since that date and review ICS authentication and session logs for anomalies.
- Leader — Act: Confirm this week whether your organization runs Ivanti Connect Secure and demand a patch status and exposure assessment from your engineering team; Ivanti ICS has a pattern of nation-state exploitation that is likely to trigger customer or board questions.
This entry was curated and judged by AI (Claude) with automated enrichment
(CISA KEV / EPSS / public PoC). Verify against the original source before
acting. Found a bad verdict?
Report it —
confirmed errors go to the corrections log.