Two Ivanti Connect Secure zero-days that attackers have chained since October 1 finally have patches. CISA added both to the Known Exploited Vulnerabilities catalog on the same day, confirming what defenders already suspected: remote access gateways remain the preferred initial access vector for advanced threat actors in 2026. That headline alone would make for a full briefing - but today also brings the first confirmed nation-state weaponization of an AI penetration testing framework, a ransomware campaign targeting backup NAS devices, and a CVSS 10 in Siemens OT gateways.

In the News

Ivanti Patches Two Chained Connect Secure Zero-Days Exploited Since October

Ivanti released patches for CVE-2026-111357 and CVE-2026-118527, two zero-day vulnerabilities in Connect Secure that have been chained together in active attacks since at least October 1, 2026. The exploit chain bypasses authentication on the VPN gateway and achieves remote code execution without user interaction. CISA added both CVEs to the Known Exploited Vulnerabilities catalog, confirming exploitation against government and enterprise environments.

This is not the first time Ivanti Connect Secure has appeared in the KEV catalog - the platform has become a recurring target because it sits at the network edge, handles authentication, and often runs with elevated privileges on flat networks. The chaining of two distinct vulnerabilities signals an adversary with the capability and patience to develop reliable exploit chains rather than relying on single-shot vulnerabilities.

What defenders should do: Patch immediately to the latest Ivanti Connect Secure version. Run the Ivanti Integrity Checker Tool (ICT) to verify no compromise occurred during the exposure window. If patching requires a maintenance window, implement network segmentation to isolate the VPN gateway and enforce conditional access policies that limit lateral movement from VPN-authenticated sessions. MITRE ATT&CK: T1190 (Exploit Public-Facing Application), T1078 (Valid Accounts).

Chinese APT Weaponizes AI Pen-Test Framework Against 200+ Organizations

A Chinese state-sponsored threat actor repurposed ARTEX, a multi-agent AI penetration testing framework, to automate attacks against more than 200 organizations across 14 countries. This is the first confirmed in-the-wild use of agentic AI offensive tooling by a nation-state group. The framework orchestrates multiple AI agents that divide attack phases: one agent handles network enumeration, another generates exploitation payloads tailored to discovered vulnerabilities, and a third manages post-compromise persistence and credential harvesting.

The operational significance is speed and scale. A human operator running the same attack chain against 200 targets would take months. ARTEX compressed that timeline to weeks by parallelizing reconnaissance and adapting exploitation payloads based on each target’s specific technology stack. The framework does not rely on a single vulnerability - it identifies whatever is exposed and generates an appropriate attack path.

What defenders should do: This changes the math on detection timelines. Automated reconnaissance at machine speed means traditional alert thresholds for scanning activity need to be lowered. Behavioral analytics that baseline normal authentication patterns and flag deviations are the primary detection category. Monitor for rapid sequential access attempts across multiple services from single source identities. MITRE ATT&CK: T1595 (Active Scanning), T1059 (Command and Scripting Interpreter), T1078 (Valid Accounts).

C3RB3R Ransomware Surges Against Synology NAS Backup Devices

Synology warned customers of an active C3RB3R ransomware campaign exploiting a DiskStation Manager (DSM) vulnerability that was patched in December 2024. Devices that remain unpatched - particularly in SMB and branch office environments where NAS appliances serve as primary backup targets - are being encrypted at scale. The campaign specifically targets NAS devices because encrypting backups eliminates the victim’s primary recovery path, increasing ransom payment pressure.

This is a pattern that repeats across every ransomware campaign: backup infrastructure that sits on the same network segment as production systems, runs outdated firmware, and has no immutable snapshot capability is not a backup - it is an assumption. A backup you have never restored from a confirmed-clean state is a hope, not a control.

What defenders should do: Patch all Synology DSM instances to the latest version. Verify that NAS devices used for backup are on a segmented network unreachable from standard user VLANs. Implement immutable snapshots where supported. Test a full restore from backup within the next 7 days - if you cannot complete one, your backup strategy has a gap. MITRE ATT&CK: T1486 (Data Encrypted for Impact), T1490 (Inhibit System Recovery).

Siemens SIMATIC IoT2050 CVSS 10 Under Active Exploitation

CVE-2026-58115, a maximum-severity missing-authentication vulnerability in the Siemens SIMATIC IoT2050 Advanced gateway, is under active exploitation in industrial environments. The flaw requires no authentication and enables remote code execution on devices that commonly serve as edge compute nodes bridging IT and OT networks. A CVSS 10 with missing authentication means the attack surface is effectively unauthenticated remote code execution - the lowest possible barrier for exploitation.

What defenders should do: Apply the Siemens patch immediately. If a maintenance window is required, isolate affected IoT2050 devices behind a dedicated OT segmentation boundary with protocol-aware inspection. Audit whether any SIMATIC IoT2050 devices have routes to the corporate IT network - if they do, sever those routes until patching is confirmed. MITRE ATT&CK: T1190 (Exploit Public-Facing Application).

Defender Action Items

  • Ivanti Connect Secure: Patch CVE-2026-111357 and CVE-2026-118527 immediately. Run ICT integrity checks on all appliances. Segment VPN gateways and enforce conditional access on VPN-authenticated sessions.
  • Synology NAS: Update DSM to latest version. Segment backup NAS from production networks. Verify immutable snapshots are enabled and test a full restore.
  • Siemens SIMATIC IoT2050: Apply patch or isolate behind OT segmentation boundary. Audit IT/OT network routes to confirm no direct path from corporate network to unpatched gateways.
  • GitLab: Patch CVE-2026-97229. Audit CI/CD pipelines for unauthorized job modifications. Over 1,000 internet-exposed instances remain vulnerable.
  • AI-driven threats: Lower scanning detection thresholds. Baseline authentication patterns and alert on rapid sequential access attempts across multiple services.

Detection Spotlight

The Ivanti Connect Secure exploit chain produces distinctive log artifacts. The following Splunk SPL query identifies potential exploitation attempts by looking for unauthenticated access patterns to ICS management endpoints followed by post-authentication command execution - the two-stage pattern characteristic of the CVE-2026-111357/CVE-2026-118527 chain.

index=network sourcetype=ivanti:ics:syslog
| eval event_time=_time
| search (uri_path="/api/v1/totp/user-backup-code/*" OR uri_path="/api/v1/system/maintenance/*/")
  AND http_status=200
  AND NOT authenticated=true
| stats earliest(event_time) as first_hit, latest(event_time) as last_hit,
        dc(uri_path) as unique_paths, values(src_ip) as source_ips by dest_host
| where unique_paths >= 2
  AND (last_hit - first_hit) < 300
| table dest_host, source_ips, unique_paths, first_hit, last_hit

This query looks for unauthenticated HTTP 200 responses to sensitive API paths within a 5-minute window on the same host - the signature of a chained exploit probing multiple endpoints in sequence. False positive rate is low in production environments because legitimate unauthenticated access to these paths should not occur. Tune uri_path values to match your specific ICS version’s API structure.

References

Subscribe to it-learn Brief

Get it-learn Brief in your inbox (Mon–Fri) - Daily cybersecurity news, SE angles, and detection queries.