Chain of Ivanti VPN Zero‑Days Exploited for Root Access, Patch Still Incomplete

An undisclosed attacker leveraged a trio of previously unknown vulnerabilities in Ivanti Connect Secure, a widely deployed VPN appliance, to execute commands with root privileges without authenticating, security researcher Volexity reported on October 13.

The three flaws—two remote code execution bugs and a privilege‑escalation issue—were combined in a single exploit chain, allowing the intruder to bypass the device's login mechanisms entirely. By chaining the vulnerabilities, the attacker could run arbitrary code as the system's highest‑privilege user, effectively compromising any network that relied on the appliance for remote access.

Ivanti responded promptly, issuing patches for two of the three zero‑day defects. The company advised customers running affected versions to apply the updates immediately and to review their security configurations. The third vulnerability remains unpatched, leaving organizations that have not yet implemented the fixes exposed to potential exploitation.

Connect Secure is a common component in corporate remote‑work setups, providing encrypted tunnels for employees and third‑party partners. The discovery of multiple zero‑days in a single product underscores the challenges of maintaining robust security in complex network devices, especially as demand for remote connectivity has surged in recent years.

Security analysts note that the rapid development of a multi‑stage exploit suggests a sophisticated threat actor, possibly with significant resources. While Volexity did not attribute the attack to a specific group, the capability to chain zero‑days points to a high level of expertise and intent to achieve persistent, high‑privilege access.

Industry experts recommend that organizations not only apply the available patches but also implement additional safeguards such as network segmentation, strict access controls, and continuous monitoring for anomalous VPN activity. Until the remaining flaw is addressed, heightened vigilance is essential.

Ivanti has pledged to release a fix for the third vulnerability as soon as possible and is working with customers to mitigate risk. In the meantime, security professionals are urged to review exposure, verify patch deployment, and consider temporary mitigation measures, such as disabling unnecessary VPN services or limiting inbound connections, to reduce the attack surface.