Hackers chain Ivanti zero days to gain remote root access

Hackers are actively chaining three zero-day vulnerabilities in Ivanti Connect Secure VPN appliances to gain root access without authentication. Cybernews, GBHackers News, and Cyber Press all report that attackers are exploiting these flaws to gain full control of vulnerable systems. CSO Online and Cyber Press confirm that the attackers do not need an existing account to log in remotely and run arbitrary commands. [1][2][4][5]

The critical entry vector relies on an authentication bypass flaw that allows remote users to skip standard login checks. According to CSO Online, Ivanti stated that it initially discovered part of this vulnerability during its internal security testing and released a patch in the July 25.1.3.0 update. However, attackers exploited the flaw before patches were backported to all versions. [2]

Cybernews and GBHackers News both report that one of the three chained zero-day vulnerabilities currently has no available fix. Cyber Daily warns that security teams must patch immediately, as active targeting is already underway in the wild. [1][3][5]

Ivanti provides network security, endpoint management, and IT services to over 34,000 customers worldwide. The company expanded its network security offerings by acquiring Pulse Secure in 2020. A zero-day vulnerability is a flaw in a system that is unknown to developers, leaving it exposed to attack until a fix is released. [6][8]