Attacker Chains Three Ivanti Connect Secure Zero-Days for Root Access, Only Two Patched So Far
Summary
Attackers have successfully chained three zero-day vulnerabilities in Ivanti Connect Secure VPN appliances to gain root access without authentication. Ivanti has released patches for two of the three flaws and urges customers to apply them immediately, with a fix for the remaining vulnerability still pending.
IFF Assessment
The chaining of multiple zero-day vulnerabilities to achieve unauthorized root access represents a significant threat to defenders by undermining the security of critical network infrastructure.
Severity
The chaining of three zero-days allows for unauthenticated remote code execution and privilege escalation to root, granting attackers complete control over the appliance, which is a critical network device.
Defender Context
This incident highlights the critical importance of prompt patching for VPN appliances, as attackers are actively exploiting chained zero-days. Defenders should prioritize monitoring for any signs of compromise on Ivanti Connect Secure devices and be prepared to isolate affected systems if immediate patching is not feasible.