Ivanti patches Connect Secure zero-day after researchers confirm in-the-wild attacks
Ivanti has released emergency updates for Connect Secure after researchers confirmed that attackers had exploited a newly disclosed zero-day. The flaw allows unauthenticated remote command execution, and Ivanti says a limited number of customers were affected at the time of disclosure.
Volexity tracks the attackers as UTA0576 and suspects a criminal motive. Their activity included credential theft, data theft, log tampering and network reconnaissance, apparently using commands available on the appliance rather than malware or web shells. Ivanti’s updates address two stages of the attack chain; a separate privilege-escalation flaw still needs a fix, which the company expects to release in the coming weeks.
- Ivanti patched an exploited Connect Secure zero-day.
- Attackers targeted credentials and network information.
- A separate privilege-escalation fix is still pending.
New here? Start with this
Connect Secure is a product organisations use to let staff connect remotely to their workplace networks. Because it sits between the public internet and an organisation’s internal systems, a weakness in the appliance can give an attacker a route inside.
A zero-day is a software flaw that attackers exploit before a fix is available. Researchers tracking this activity say the attackers stole login details and data, altered logs and explored affected networks; Ivanti’s product updates address two parts of the attack, while another flaw remains to be fixed. These incidents matter because remote-access systems can expose sensitive information and provide access to wider networks.