Our takeVolexity disclosed three chained zero-days in Ivanti Connect Secure that reach root without auth; two are patched, one is not. Patch the fixed ones now if you run it. Ivanti should ship the third immediately.Security Resilience desk
Sources (20)
- hackernews · hackernews
- cert_bund · cert_bund
- cert_bund · cert_bund
- cert_bund · cert_bund
- cert_bund · cert_bund
- cert_bund · cert_bund
- cert_bund · cert_bund
- cert_bund · cert_bund
- cert_bund · cert_bund
- cert_bund · cert_bund
- cert_bund · cert_bund
- cert_bund · cert_bund
- cert_bund · cert_bund
- cert_bund · cert_bund
- cert_bund · cert_bund
- cert_bund · cert_bund
- cert_bund · cert_bund
- cert_bund · cert_bund
- cert_bund · cert_bund
- cert_bund · cert_bund
What this means for you — Security leader:Patch Ivanti Connect Secure to the latest version immediately if you run it; the third zero-day remains unpatched and chaining is already in the wild.
What this means for you — Lean IT orgs:If you use Ivanti Connect Secure VPN, update it right now or switch it off until the final patch lands — attackers are already chaining these flaws for root access.
What this means for you — MSP:Check every client running Ivanti Connect Secure and push the available patches today; the third zero-day is still unpatched and active exploitation is confirmed.
What this means for you — Researcher:Volexity disclosed three chained Ivanti Connect Secure zero-days leading to unauthenticated root; two fixed so far, one pending.