Ivanti VPN attacks steal credentials despite fully patched appliances
This is a DailyCyber.News update, brought to you by BareMetalCyber.com, for Wednesday, October 14th, 2026.
Attackers gained root access to an Ivanti Connect Secure appliance that was fully patched when the intrusion began. The chain combined three previously unknown weaknesses, required no authentication, and gave the actor a path to sensitive internal identity data. Investigators found searches for Active Directory credentials, recovery keys, and passwords, along with activity that appeared to prepare for movement into the wider network. Ivanti has fixed part of the chain, but a privilege-escalation fix was still pending.
The attacker also used in-memory changes, restored settings, and deleted logs, which helped the activity evade routine file checks. That means applying an update doesn’t prove an appliance was never compromised. Leaders need to treat patching and compromise assessment as separate decisions. Defenders should conduct forensic triage, review credentials and network evidence, and investigate exposed appliances even after updates are installed.
The practical response is to update affected systems immediately, then rotate credentials if there’s any sign of exposure.
For the sources and the full Daily Cyber newsletter, visit DailyCyber.News.
