Attackers Chain Three Ivanti VPN Zero‑Days to Gain Root Access

Security researchers have identified a sophisticated attack chain involving three previously unknown zero‑day flaws in Ivanti VPN that together allow an attacker to execute code with root privileges on vulnerable systems. The findings were first reported by a joint effort between independent security analysts and Ivanti’s own incident response team, highlighting the growing complexity of remote‑access attacks.

The first vulnerability is a privilege‑escalation flaw in the VPN client’s service handling, which lets a low‑privilege user gain higher system rights. The second is an authentication bypass that permits unauthenticated network connections to the VPN gateway. The final flaw is a remote code execution bug in the gateway’s management interface, which, when combined with the first two, enables an attacker to run arbitrary commands as the root user across the network.”

For businesses that rely on Ivanti VPN to support remote work—common among Australian small and medium enterprises—the exploit could give threat actors unrestricted access to internal servers, databases, and employee devices. Such access can be used to steal data, deploy ransomware, or establish persistent footholds for future attacks, underscoring the critical nature of the risk.”

Ivanti has released patches for all three vulnerabilities and urges customers to apply them immediately. In the meantime, organisations should enforce multi‑factor authentication on VPN connections, restrict access to trusted IP ranges, and monitor logs for unusual login attempts. Deploying network‑level segmentation and ensuring that privileged accounts are limited to essential personnel can also mitigate potential damage.”

The Australian Cyber Security Centre (ACSC) has issued an advisory urging Australian SMEs to verify that their Ivanti VPN installations are up‑to‑date and to work closely with their managed service providers to confirm remediation. Prompt patching, combined with strong authentication practices, is essential to protect Australian businesses from this emerging threat.