What happened
An attacker exploited three zero-day vulnerabilities in Ivanti Connect Secure, a VPN appliance, to execute commands with root privileges without requiring user authentication. This chain of exploits has been confirmed to be actively used in the wild, posing a significant security risk. Ivanti responded by releasing patches for two of the flaws; however, a fix for the third flaw remains pending. The vulnerabilities were disclosed by Volexity, who also reported their findings to Ivanti.
Who is affected
Organisations operating Ivanti Connect Secure appliances are potentially impacted by these vulnerabilities. Those using affected versions without applying the available updates for the two patched flaws remain vulnerable to exploitation, especially as the chain of zero-days has demonstrated active attack capabilities. It is important to note that the vulnerabilities can be exploited remotely without authentication, elevating the risk for affected deployments.
Recommended actions
Immediately update Ivanti Connect Secure to the latest available versions that include patches for the two known flaws.
Monitor network traffic and system logs for signs of exploitation or unusual activity indicating the active use of these vulnerabilities.
Consider implementing network segmentation and restricting access to VPN appliances to limit exposure to potential attacks.
