Ivanti Connect Secure: three chained flaws grant unauthenticated root

Remote access security is once again in the spotlight. The U.S. agency CISA has added two vulnerabilities affecting Ivanti Connect Secure to its catalog of actively exploited flaws (KEV), after their real-world use in attacks was confirmed. The advisory comes with a particularity that raises the severity: attackers do not need a single breach, but rather chain three flaws to reach root privileges without previously authenticating to the system.

What exactly happened

According to the published information, the list of vulnerabilities includes at least one with a CVSS score of 8.8, described as a lack of authentication in a critical function. In other words, a part of the product that should require credentials is not validating them correctly, which opens the door for a malicious actor to interact with the system without identifying themselves. From there, chaining with two other defects allows escalation to full control of the device.

It is worth pausing on the nuance: this is not an isolated flaw in a specific version, but rather an exploitation sequence. This complicates detection, because an attack attempt may look like legitimate traffic across several phases and only give itself away when the third link is activated. For an IT team with limited resources, that is the worst possible combination: high impact and low visibility.

Why it matters to an SMB

Ivanti Connect Secure is a corporate VPN gateway. And therein lies the problem: it is not just any server in a corner of the network, but the point through which remote employees, suppliers and, in many cases, connections between sites pass. If an attacker obtains root on that device, they do not only compromise the appliance: they place themselves in a privileged position to observe and move laterally toward the rest of the infrastructure.

For an SMB, this translates into a very concrete risk. Many small organizations outsource the management of their VPN or configure it once and forget about it. If the team maintaining it is not reviewing security advisories regularly, a flaw of this type can go unnoticed for weeks. And you do not need to be a priority target: attackers automate scanning of this type of device because they know they are exposed to the internet.

A compromised VPN appliance is not a perimeter incident: it is a master key inside your network.

What we recommend doing

1. Identify whether you have Ivanti Connect Secure in production. Sometimes the inventory is not up to date and the device is managed by a third party. Ask your provider explicitly.
2. Apply the available updates as soon as possible. When CISA includes a flaw in KEV, exploitation is already happening. Do not wait for the quarterly maintenance window.
3. Review access logs from the last few days. Look for anomalous authentications, sessions from unexpected locations or unplanned configuration changes.
4. Rotate credentials and certificates for the device if you suspect it may have been exposed. Unauthenticated root implies that stored keys may be in someone else's hands.
5. Check system integrity with the tools recommended by the manufacturer to detect persistent modifications.

The context: security as a process, not as a patch

This case fits a trend we have been observing on the blog: the attack surface is shifting toward the components we take for granted. Just as we commented when discussing the fake ChatGPT and Claude apps that install miners, the weak link is rarely the most visible one. The same happens here: the VPN device is installed, configured and forgotten, but it remains a door exposed to the internet 24 hours a day.

The lesson for a small IT team is twofold. On the one hand, maintain a living inventory of all services published externally, with an assigned owner and last review date. On the other, assume that CISA advisories are a signal for immediate action, not an informational bulletin. The difference between reacting in 24 hours or in three weeks can be the difference between a scare and an incident with compromised data.

If your organization does not have the capacity to monitor this type of advisory continuously, perhaps it is time to consider a managed detection and response service. It is not about buying more tools, but about ensuring that someone with judgment is looking at what matters when it matters.

Source: The Hacker News. Analysis and adaptation: ForgeNEX.