Ivanti's VPN Nightmare: Three Zero-Days, One Unpatched, and You
Emily Davis ·
Listen to this article~3 min
An attacker chained three zero-day flaws in Ivanti Connect Secure to gain root access without logging in. Two flaws are patched, but the third remains open. Here's what you need to do now.
Security researchers at Volexity dropped a bombshell on October 13: an attacker chained three zero-day vulnerabilities in Ivanti Connect Secure, a widely used VPN appliance, to execute commands as root without even logging in. That's right—no username, no password, just full control. Ivanti has since patched two of the three flaws, but the third remains wide open. If you're running an affected version, the company's message is blunt: "act immediately."
### What Exactly Happened?
Volexity discovered the flaws and reported them to Ivanti. The attacker combined all three to achieve remote code execution with root privileges—the highest level of access on a Linux system. Think of it like a burglar who doesn't just pick your lock but also rewires your entire security system to let them come and go as they please. The first two vulnerabilities now have fixes, but the third is still unpatched, leaving a window for attackers to exploit.
### Why This Matters to You
If your organization relies on Ivanti Connect Secure for remote access—and thousands do—this isn't just another patch Tuesday. It's a race against time. The attacker didn't need credentials, which means any exposed appliance could be a target. And because the third flaw is still unpatched, even fully updated systems might not be safe until Ivanti releases that final fix.
### What Should You Do Right Now?
- **Check your version**: Determine if you're running an affected Ivanti Connect Secure release. Ivanti's advisory lists the vulnerable versions.
- **Apply available patches**: Install the fixes for the first two flaws immediately. Don't wait for the third.
- **Monitor for signs of compromise**: Look for unusual outbound traffic, unexpected processes, or new admin accounts. Volexity's report includes indicators of compromise.
- **Consider temporary mitigations**: If you can't patch right away, Ivanti recommends specific workarounds, like restricting access to the management interface.
- **Plan for the third patch**: Set a reminder to apply the final fix as soon as it's available. Subscribe to Ivanti's security alerts.
### The Bigger Picture
Zero-day chains are becoming more common because attackers know that single flaws are often patched quickly. By combining multiple vulnerabilities, they can bypass layered defenses and maintain persistence. For defenders, this means moving beyond a reactive patch cycle. You need continuous monitoring, network segmentation, and a healthy dose of paranoia.
As Volexity put it, "The attacker chained three zero-day flaws... to run commands as root without logging in." That's a sobering reminder that even your most trusted security appliances can become entry points. Stay vigilant, patch what you can, and keep an eye out for that third fix. Your network's integrity depends on it.
