Ivanti Connect Secure hit by chained zero-day exploits; one flaw remains unpatched

Key points

• Three vulnerabilities affect Ivanti Connect Secure VPN appliances.
• Attackers chained exploits to achieve unauthenticated command execution and root access.
• Two flaws have fixes; one remains pending as of the October 13 disclosure.
• Volexity reported the activity and Ivanti urged immediate action.
• No CVE identifiers were listed in the available facts.

Security researchers at Volexity have exposed a campaign in which an intruder combined multiple weaknesses in Ivanti's Connect Secure remote-access product. The target is a VPN appliance that many organizations place at the network edge. By linking exploits, the attacker could execute commands without first authenticating and ultimately obtain the highest privilege level on the device. The activity is described as zero-day exploitation, meaning the vendor had no advance fix when the attacks began.

The disclosure covers three separate flaws. Two of them now have vendor-supplied patches, while the third remains unresolved. The timeline points to October 13 and the 2026/10 period. Ivanti released fixes for the patched issues and pressed customers to take immediate action. Volexity reported the flaws and the exploitation pattern. No CVE numbers were included in the facts available for this analysis.

Any organization running Ivanti Connect Secure as an internet-facing VPN gateway should treat this as urgent. Because the appliance often sits at the boundary between public networks and internal resources, a compromise can expose credentials, session data, and routes into protected systems. The unauthenticated nature of the command execution lowers the barrier for attackers and raises the risk for agencies, schools, and other public-sector networks that rely on remote access.

Edge devices remain a favored target because they are reachable from anywhere and often run with elevated permissions. Chaining flaws lets an adversary bypass individual mitigations and turn separate bugs into a full compromise. Even with two patches available, the pending third issue means defenders cannot close the book yet. The lack of CVE identifiers also complicates tracking and vulnerability management until more details emerge.

Administrators should monitor vendor advisories for the outstanding fix, review logs for unusual VPN activity, and prepare for possible device rebuilds if compromise is suspected. Watch for follow-up from Ivanti and Volexity, including indicators of compromise, updated patch guidance, and any clarification on affected versions. Until the final flaw is addressed, assume that unpatched appliances remain at elevated risk.

What to do now

1. Apply Ivanti's available patches for the two fixed flaws immediately, then schedule an emergency change for the third once a fix ships.
2. If patching is not yet possible, isolate or restrict access to the Connect Secure appliance at the network edge, limiting source IPs and administrative interfaces.
3. Enable and centralize logging for the VPN appliance, then hunt for signs of unauthenticated command execution, unexpected root-level changes, and unusual outbound connections.
4. Reset credentials and revoke active sessions for users who traversed the appliance, especially privileged accounts, if compromise is suspected.
5. Preserve forensic evidence before rebuilding; capture memory, logs, and configuration, then rebuild from a known-good image if indicators are confirmed.
6. Monitor Ivanti and Volexity advisories for CVE assignments, indicators of compromise, and updated mitigation guidance.
7. Review remote-access architecture and enforce MFA, least privilege, and segmentation to reduce exposure from edge-device compromises.

Original source

The Hacker News