Ivanti attack chain includes unpatched privilege escalation flaw

A threat actor tracked as UTA0576 chained three vulnerabilities in Ivanti Connect Secure appliances to gain unauthenticated root access, SOC Prime reported, citing a Volexity investigation. The chain combined authentication bypass, remote code execution and an unpatched privilege escalation flaw. The attacker used staged payloads held in memory and tampered with logs, complicating forensic analysis. SOC Prime advises upgrading to version 22.8R2.5 or later, or moving to the 25.1 code line, while continuing to monitor for compromise. Ivanti's Integrity Checker Tool may miss in-memory modifications.