Chained Zero-Day Exploits in Ivanti Connect Secure Enable Unauthenticated Root Access

An attacker exploited three zero-day vulnerabilities in Ivanti Connect Secure to achieve root access without authentication, with two flaws patched and one remaining unresolved. Security firm Volexity reported the flaws to Ivanti, urging immediate action for affected versions.

An attacker chained three zero-day flaws in Ivanti Connect Secure, a VPN appliance, to run commands as root without logging in, security firm Volexity said on October 13. Ivanti has released fixes for two of the flaws and told customers on affected versions to "act immediately." A fix for the third is still pending, according to Volexity.

Volexity, which reported the flaws to Ivanti,

Read original article