Ivanti Zero-Day: When a Known Vulnerability Becomes an Exploited One

CyberScoop reports that a vulnerability in Ivanti Connect Secure — a widely deployed remote access and VPN platform — became a zero-day after Ivanti identified part of the flaw during internal security testing in June 2026 but concluded it did not meet the threshold required for an out-of-band emergency patch release. Attackers subsequently discovered and began actively exploiting the vulnerability before a fix was made available, converting what had been an internal finding into an actively exploited zero-day. The incident raises important questions about how vendors assess and communicate vulnerability severity, and about the degree to which organisations can rely on vendor timelines to manage their own exposure.

Why this matters for UK organisations

Ivanti Connect Secure is widely used across UK organisations as a remote access and network security solution, making this vulnerability directly relevant to many IT and security teams. The broader lesson, however, extends beyond this specific product. When a vendor identifies a flaw internally but decides not to release an emergency fix, customers have no visibility of the risk and are unable to take compensating action — such as additional monitoring, access restrictions or temporary workarounds. This creates a window of exposure that organisations cannot manage because they do not know it exists. The incident is a useful reminder that vendor patch timelines and attacker timelines do not always align, and that the gap between the two is where organisations are most vulnerable.

What to review

If your organisation uses Ivanti Connect Secure, confirm that the latest available patch has been applied and review access logs for signs of unusual or unauthorised activity, particularly around remote access sessions. Subscribe directly to Ivanti's security advisories so your team receives notifications promptly rather than relying solely on automated update channels. More broadly, review how your organisation monitors vendor security communications for all critical remote access and network security tools, and consider whether your third-party risk processes include a mechanism for tracking vendor-disclosed vulnerabilities even when no patch has yet been released. Proactive monitoring of vendor advisory channels is a low-cost way to reduce the gap between disclosure and action.

Source: CyberScoop