Exploited Ivanti VPN zero‑days give attackers root access with no login
Attackers are chaining three previously unknown flaws in Ivanti Connect Secure VPN appliances to gain root access and steal stored credentials without even logging in. With Ivanti confirming in‑the‑wild exploitation and only two of the three bugs patched so far, government and corporate networks face a live-entry problem at the edge of their systems.
A critical set of security flaws in Ivanti’s widely used Connect Secure VPN appliances is being actively exploited to give attackers root‑level control of devices and access to stored credentials without any need to log in, creating a high‑risk entry point into government and corporate networks.
Researchers and incident responders report that a threat actor has chained together three zero‑day vulnerabilities — bugs that were unknown to the vendor and had no patches when exploitation began — on fully patched Ivanti Connect Secure systems. By leveraging the chain, the attacker can execute commands as root, the highest privilege level on the underlying operating system, and quietly extract credentials cached on the VPN.
Ivanti has confirmed that the flaws are being exploited in the wild. The company has released patches for two of the three vulnerabilities but is still working on a fix for the third, leaving defenders in a familiar and uncomfortable position: they must secure a product that faces the open internet while its vendor races to close a hole adversaries are already using.
For the organizations that rely on Ivanti Connect Secure to provide remote access for employees, the practical risk goes beyond one compromised box. VPN appliances typically sit at the boundary between the internet and internal networks, hold sensitive configuration data, and often integrate with single sign‑on or identity systems. Once an attacker gains root on such a device and steals stored usernames and passwords or tokens, they can attempt to pivot deep inside the network, impersonate legitimate users, and evade many standard monitoring tools.
The fact that these attacks have been observed against fully patched appliances underscores a broader lesson: keeping up with scheduled updates is no longer enough when high‑value edge devices are attractive targets for capable adversaries. State‑backed groups and well‑resourced cybercriminals routinely hunt for fresh bugs in VPNs, firewalls, and email gateways because compromising one box can open thousands of doors downstream.
Operationally, network administrators now face an urgent checklist. They must identify all Ivanti Connect Secure instances in their environment, apply the available fixes for the first two zero‑days, and implement whatever temporary mitigations Ivanti recommends for the unresolved vulnerability. They also need to assume, at least for investigation purposes, that credentials stored on exposed appliances may already be compromised and consider resetting or rotating them.
The strategic stakes are larger than one vendor. Over the past several years, successive waves of attacks against VPN platforms have given intruders footholds in ministries, defense contractors, healthcare systems, and critical infrastructure operators around the world. Each such campaign erodes confidence in the tools that modern remote work and distributed operations depend on.
A useful way to grasp the severity is this: when a VPN box designed to enforce who gets in can be turned into a silent superuser that lets intruders walk through with stolen keys, the organization’s security model flips upside down. Trust in that edge device has to be rebuilt, not assumed.
The key signs to watch next are whether Ivanti accelerates the release of the third patch, whether major governments issue formal advisories or directives covering Ivanti appliances, and whether additional threat groups beyond the first identified attacker begin scanning and exploiting the same flaws. Evidence of broad scanning spikes or ransomware crews adding this chain to their playbooks would quickly move the issue from a targeted espionage concern to a mass‑exploitation crisis.
Sources
- OSINT