Attacker Chains Three Ivanti Connect Secure Zero-Days for Root Access, Only Two Patched So Far

An attacker exploited three zero-day vulnerabilities in Ivanti Connect Secure, a VPN appliance, to gain root access without authentication. Security firm Volexity disclosed the issue, stating that the attacker chained these flaws to run commands as root. Ivanti has released patches for two of the vulnerabilities and advised affected customers to take immediate action. However, a fix for the third vulnerability is still pending, according to Volexity, which initially reported the flaws to Ivanti.