Four Years of Zero-Days in the Same VPN: When Does Your Board Ask a Different Question?

On October 13, threat intelligence firm Volexity published findings that should stop every board member mid-sentence the next time someone says, “We patched it.” Researchers discovered that an unknown attacker had chained three previously unknown vulnerabilities in Ivanti Connect Secure, a widely deployed corporate VPN, to gain root-level access to a fully patched appliance. CISA added the lead flaw, CVE-2026-104935, to its Known Exploited Vulnerabilities catalog the same day and gave federal agencies just three business days to apply the fix.

That alone would be newsworthy. What makes this a governance story, not just a technology story, is the pattern behind it. This is the fourth consecutive year that Ivanti Connect Secure has been targeted through zero-day vulnerabilities exploited in the wild.

A Pattern, Not an Incident

In 2021, attackers exploited CVE-2021-22893 to breach dozens of government, defense, and financial organizations across the United States and Europe. In January 2024, suspected state-sponsored actors chained CVE-2023-46805 and CVE-2024-21887 for remote code execution on Connect Secure appliances. In January 2025, CVE-2025-0282 was exploited before Ivanti could issue a patch. And now, in October 2026, CVE-2026-104935 continues the cycle.

Each incident prompted the same response: patch, scan, resume operations. Each time, a new zero-day appeared within months. At some point, the question stops being “Did we patch?” and becomes “Why are we still relying on a product with this track record?”

That second question belongs in the boardroom.

What Happened This Time

The October 2026 attack, attributed to a threat actor Volexity tracks as UTA0576, is notable for what it did and what it did not do. The attacker chained three zero-day flaws to move from unauthenticated outsider to root-level administrator on a device running the latest available software. Ivanti has released fixes for two of the three vulnerabilities. The third, a privilege-escalation flaw, remained unpatched as of Volexity’s disclosure.

What makes this attack especially difficult to detect is the attacker’s discipline. UTA0576 deployed no malware and left no web shell. Instead, they re-exploited the device each time they needed to run a command and tampered with logs to cover their tracks. Ivanti’s own Integrity Checker Tool did not flag the compromise.

Once inside, the attacker stole LDAP and domain credentials stored on the appliance, searched Active Directory for local administrator passwords and BitLocker recovery keys, and ran password-spraying attacks against internal systems. In other words, the VPN was not the target. It was the door. Everything behind it was.

The Three Questions Your Board Should Ask

In Cyber Risk Is Business Risk, I outline a framework built on three questions every board should be asking about any critical system:

What do we have? Most organizations know they have a VPN. Fewer know how many appliances are deployed, which firmware versions they run, and whether their vendor’s security track record has been reviewed in the last year. If your security team cannot answer “How many Ivanti appliances do we operate, and are they all on the fixed version?” within an hour, that is a gap the board should know about.

What can go wrong? The answer here is no longer theoretical. Four years of evidence show that this product family attracts sophisticated attackers, that zero-day exploitation can begin before patches exist, and that the vendor’s own detection tools may not catch a compromise. The risk is not hypothetical. It is documented, repeated, and ongoing.

What are we doing about it? Patching is necessary but insufficient when the pattern repeats annually. Boards should be asking whether the organization has evaluated alternatives, whether network segmentation limits the blast radius of a VPN compromise, and whether the security team has the forensic capability to detect attacks that leave no malware behind.

When Patching Becomes a Treadmill

There is a meaningful difference between a vendor that has an occasional vulnerability and a product that appears on CISA’s exploited-vulnerabilities catalog year after year. Ivanti products account for roughly 35 entries on that catalog across their product line, a figure that should appear in any vendor risk review.

Boards do not need to make technology purchasing decisions. But they do need to set the expectation that management reviews vendor risk with the same rigor applied to any other critical supplier. If a parts supplier delivered defective components four years in a row, no board would accept “we inspected each batch and sent back the bad ones” as a long-term strategy. They would ask whether it was time to find a different supplier.

The same logic applies here. Replacing an entrenched VPN platform is expensive and disruptive. But so is responding to a breach that began through a product with a known pattern of compromise. The board’s job is to make sure someone is weighing those costs against each other, not just absorbing the patching treadmill as normal operations.

What to Ask Your CISO This Week

If your organization uses Ivanti Connect Secure, or any VPN appliance with a history of zero-day exploitation, bring these questions to your next security briefing:

1. Are we running the fixed version? Ivanti released patches on October 13. If your team has not applied them, ask why and what compensating controls are in place.
2. Can we detect an attack that leaves no malware? The October compromise was invisible to standard tools. Ask whether your team has the network telemetry and forensic capability to spot credential theft originating from the VPN itself.
3. When was the last vendor risk review for this product? If the answer is “never” or “more than a year ago,” that review is overdue.
4. What is our exit plan? Not a demand to replace the product tomorrow, but a request for a documented assessment of alternatives, migration costs, and the risk of staying.

The Governance Lesson

Zero-day vulnerabilities are a fact of life in cybersecurity. No vendor is immune. But when the same product family appears in the same kind of headline four years running, it stops being an isolated event and starts being a pattern that demands a strategic response.

Boards that treat each incident as a one-time patching exercise will find themselves here again next year. Boards that ask harder questions about vendor concentration, detection capability, and long-term alternatives will be the ones that break the cycle.

The VPN is your organization’s front door. If the lock keeps failing, eventually you need a better lock, not just a faster locksmith.