Two more Ivanti Connect Secure zero-days are on the CISA KEV list, extending an exploitation chain that has been active since October 1. The SSL VPN category continues to absorb zero-day after zero-day, and the pattern is no longer an anomaly - it is the operational baseline for this product class. Separately, C3RB3R ransomware is hitting Synology NAS appliances, and a Teams-based social engineering chain is yielding domain controller certificates through AD CS abuse.

In the News

Ivanti Connect Secure Zero-Day Chain - CVE-2026-111357 and CVE-2026-118527

Ivanti has patched two additional zero-day vulnerabilities in Connect Secure that have been chained together in active attacks since at least October 1, 2026. CVE-2026-111357 and CVE-2026-118527 are now listed on CISA’s Known Exploited Vulnerabilities catalog, triggering mandatory remediation timelines for federal agencies.

The exploit chain follows a familiar pattern for this product: initial access through the VPN appliance, followed by persistence mechanisms that survive standard remediation steps. Ivanti Connect Secure has appeared on CISA KEV repeatedly since the January 2024 wave of CVE-2023-46805 and CVE-2024-21887 exploitation - this is not an isolated event but a sustained pattern of zero-day exposure in the SSL VPN category.

For organizations still running SSL VPN concentrators, the calculus has shifted. Each new zero-day adds weight to the argument that the entire product category - not just a single vendor - carries structural risk that patching alone cannot resolve. SSE and ZTNA architectures eliminate the internet-facing attack surface that makes these exploits possible. Organizations that cannot migrate immediately should ensure their Ivanti appliances are patched to the latest version, run the Ivanti Integrity Checker Tool, and monitor for indicators of compromise from the October campaign.

What defenders should do: Patch Ivanti Connect Secure immediately. Run the Integrity Checker Tool to detect signs of prior compromise. Begin architectural planning for ZTNA migration to eliminate the SSL VPN attack surface entirely.

C3RB3R Ransomware Surge Targets Synology NAS

Synology has issued an urgent advisory warning customers of an active C3RB3R ransomware campaign targeting its network-attached storage devices. Attackers are exploiting unpatched NAS appliances to encrypt shared file storage - and in environments with flat network architectures, these devices become pivot points for lateral movement.

NAS devices occupy a difficult position in most security architectures. They rarely run endpoint detection agents, they are often excluded from vulnerability scanning cadences, and they sit on network segments with broad access from endpoints, servers, and backup infrastructure. When ransomware reaches a NAS appliance, it frequently encrypts backup repositories alongside production data - eliminating the recovery path that defenders are counting on.

The C3RB3R campaign reinforces the need for network-layer visibility into east-west traffic. If your detection stack cannot see SMB/NFS traffic flows to and from NAS appliances, lateral movement to storage infrastructure is invisible until encryption begins.

What defenders should do: Patch Synology NAS firmware immediately. Verify that NAS devices are segmented from general endpoint VLANs. Ensure backups stored on NAS are immutable or replicated to an isolated target. Deploy network detection and response (NDR) covering NAS traffic segments.

Teams Impersonation and AD CS Abuse Yield Domain Controller Certificates

In two confirmed intrusions reported by The Hacker News, attackers impersonated IT support staff on Microsoft Teams, convinced users to grant remote desktop control, then exploited misconfigured Active Directory Certificate Services (AD CS) to enroll for domain controller certificates. The result: full domain compromise from a social engineering entry point, with no malware delivery required for initial access.

The attack chain maps to a well-documented set of AD CS escalation paths (ESC1 through ESC8). Misconfigured certificate templates - particularly those that allow low-privileged users to request certificates with Subject Alternative Names (SANs) specifying privileged accounts - remain one of the most impactful and least-audited privilege escalation vectors in Active Directory environments. Tools like Certify and Certipy have made enumeration and exploitation accessible to commodity threat actors, not just advanced groups.

The initial access vector - Teams social engineering - is a reminder that external collaboration settings in Microsoft 365 tenants default to permissive. Most organizations have not restricted external users from initiating Teams chats, sending meeting invitations, or requesting screen-sharing sessions with internal users. This is the configuration that made the impersonation possible. MITRE ATT&CK techniques involved include T1566 (Phishing), T1219 (Remote Access Software), and T1649 (Steal or Forge Authentication Certificates).

What defenders should do: Audit AD CS certificate templates using Certify or Certipy; remediate ESC1–ESC8 misconfigurations. Restrict external Teams messaging in Microsoft 365 admin settings. Deploy identity threat detection monitoring for anomalous certificate enrollment events. Enforce phishing-resistant MFA for all remote access sessions.

Defender Action Items

  • Ivanti Connect Secure: Patch CVE-2026-111357 and CVE-2026-118527 immediately. Run the Ivanti Integrity Checker Tool. Begin ZTNA migration planning to eliminate SSL VPN exposure.
  • Synology NAS: Apply latest firmware. Segment NAS devices from endpoint VLANs. Verify backup immutability - a backup on the same NAS is not a backup. Deploy NDR covering NAS traffic.
  • AD CS and Teams: Audit certificate templates for ESC1–ESC8 misconfigurations using Certify or Certipy. Restrict external collaboration in Teams admin settings. Monitor Event ID 4887 (certificate enrollment) for anomalous requests.
  • LXD/MicroCloud (CVE-2026-XXXXX): If running Canonical LXD or MicroCloud, patch the CVSS 10.0 authentication bypass that allows client impersonation with only a public certificate.

Detection Queries

Monitor for anomalous AD CS certificate enrollment - the detection signal for the Teams-based attack chain. Event ID 4887 fires on every certificate enrollment in Windows Security logs. The following Splunk SPL query surfaces enrollments targeting domain controller templates by non-machine accounts, which should be rare to nonexistent in a healthy environment:

index=wineventlog EventCode=4887
| eval template=CertificateTemplate
| search template="DomainController" OR template="DomainControllerAuthentication" OR template="DirectoryEmailReplication"
| where NOT match(SubjectName, "\$$")
| stats count by SubjectName, RequesterName, template, ComputerName
| where count > 0

If this returns results, a non-machine account has enrolled for a domain controller certificate template - investigate immediately. False positive rate is near zero in environments where DC certificate enrollment is properly restricted to machine accounts.

References

Subscribe to it-learn Brief

Get it-learn Brief in your inbox (Mon–Fri) - Daily cybersecurity news, SE angles, and detection queries.