Ivanti warns of actively exploited zero-day vulnerability in Connect Secure gateway

Why This Matters

• Organisations using Ivanti Connect Secure face immediate risk of compromise, as the flaw allows unauthenticated remote code execution on internet-exposed appliances.
• The threat actor's evasive tactics, including log tampering and malware-free operations, bypass standard detection tools such as Ivanti's Integrity Checker, making incidents harder to identify.
• Remote access gateways are critical infrastructure for hybrid workforces; a successful breach can lead to lateral movement inside corporate networks and data exfiltration.

Background

Ivanti Connect Secure, formerly known as Pulse Connect Secure, is a widely deployed SSL VPN appliance that provides remote employees and contractors with secure access to corporate resources. The product has been a frequent target of state-sponsored and cybercriminal groups; multiple zero-day vulnerabilities have been exploited in past campaigns, including incidents linked to Chinese and North Korean threat actors. Ivanti typically releases emergency patches and urges immediate deployment, but the gap between disclosure and widespread exploitation can be narrow.

Key Perspectives

Ivanti: The vendor urges customers to review its security advisory, upgrade to the fixed version immediately, and run the Integrity Checker Tool regularly. It is working on a patch for the remaining privilege escalation flaw. Volexity: The security firm that discovered the chain emphasises that the actor avoided deploying malware and instead re-exploited the device for each command, covering its tracks by tampering with logs, which raises concerns about the effectiveness of existing detection mechanisms. Defused: Independent confirmation of exploitation starting October 1 corroborates the timeline and scope of the campaign, indicating the vulnerability was weaponised before public disclosure. Enterprise defenders: Security teams face the challenge of verifying that no compromise occurred before patching, given the actor's log-tampering tactics, and must decide whether to treat all exposed devices as potentially breached.

What to Watch

• Whether other threat actors quickly adopt the same exploit chain now that technical details are public.
• Ivanti's timeline for releasing a patch for the third privilege escalation vulnerability.
• Any emergency directive from CISA or other national cybersecurity agencies requiring federal agencies to apply the patch or disconnect affected devices.