Fully patched Ivanti VPNs breached through a three-flaw chain
This is a DailyCyber.News update, brought to you by BareMetalCyber.com, for Monday, October 19th, 2026.
Organizations were breached through an exploit chain that combined three previously unknown weaknesses in Ivanti Connect Secure appliances. The attackers gained root access on fully patched devices, collected credentials, exfiltrated configuration data, and performed network reconnaissance. In other words, being current on all available patches did not prevent this campaign.
A compromised V P N appliance can expose more than the device itself. Attackers may obtain access credentials and configuration details that help them understand or move deeper into the connected network. Leaders should not treat a fully patched status as proof that an internet-facing device is clean. Defenders should hunt for compromise indicators, protect relevant logs, rotate credentials that may have been exposed, and validate the integrity of each appliance. Organizations relying on these gateways should consider the wider network risk, not only whether the V P N still operates.
The larger lesson is that internet-facing infrastructure needs continuous verification, not patching alone. Investigate Ivanti Connect Secure appliances for compromise and rotate credentials that may have passed through affected devices.
For the sources and the full Daily Cyber newsletter, visit DailyCyber.News.
