Security reporting published October 13 describes a chain of three zero-day vulnerabilities in Ivanti Connect Secure that can allow an unauthenticated attacker to execute commands as root. The report attributes the analysis to Volexity and says two of the three flaws had been patched at publication.
Remote-access appliances sit at an organization’s perimeter and may provide a route into internal networks. Ivanti customers should validate their exact product version and advisory guidance, apply available mitigations and updates urgently, and restrict management interfaces to trusted administrative networks. If a patch is delayed, compensating controls should be explicit and time-bounded.
Preserve and review appliance logs, authentication events, configuration changes, and anomalous command execution around the suspected exposure period. An update alone does not establish that a device was never accessed; assess for persistence, credential theft, and lateral movement where indicators justify it.