Volexity reveals three-flaw Ivanti attack chain with root access

An attacker chained three previously unknown Ivanti Connect Secure flaws to execute commands with root privileges without logging in, Volexity disclosed October 13. The finding adds a privilege-escalation flaw to the authentication bypass and remote code execution flaws covered by Ivanti's fixes; the third fix is pending. Volexity found the attack on a customer's appliance that was fully patched when exploitation began October 3. The attacker stole stored credentials, including LDAP domain credentials, and searched Active Directory for passwords. Ivanti urged affected customers to upgrade. Volexity said Ivanti's Integrity Checker Tool misses this chain because it alters library code in memory and restores changed configuration data; confirming compromise requires forensic investigation.