Attacker Chains Three Ivanti Connect Secure Zero-Days for Root Access, Only Two Patched So Far

An attacker chained three zero-day flaws in Ivanti Connect Secure to run commands as root without logging in, Volexity reported on October 13. Ivanti has patched two of the flaws and urged customers to act immediately, but a fix for the third is still pending, leaving affected VPN appliances vulnerable.