Ivanti gateway attacks demand patching and deeper forensics
This is a DailyCyber.News update, brought to you by BareMetalCyber.com, for Thursday, October 15th, 2026.
Next, attackers are exploiting Ivanti Connect Secure gateways to gain unauthenticated root-level access. The observed attack chain targeted credentials and secrets associated with Active Directory, including local administrator passwords and BitLocker recovery keys. Some appliances were considered fully patched when they were compromised because a partial fix had not yet reached every supported version. CISA has ordered federal agencies to mitigate the issue by October 16th.
This is not a patch-only response. Built-in integrity checks may miss the activity because parts of the attack execute and disappear in memory. Leaders should understand that installing an update may close the vulnerability without proving that an exposed gateway was never compromised. Defenders may need network and memory forensics where the appliance was exposed or suspicious activity exists.
The larger pattern is the gap between fixing one product branch and protecting every supported version. Attackers can use that window. The priority is to update affected gateways immediately, restrict access, and conduct network and memory forensics on systems that may have been exposed.
For the sources and the full Daily Cyber newsletter, visit DailyCyber.News.
