Attackers have been quietly breaking into Ivanti Connect Secure VPN appliances for nearly two weeks using a chain of three previously unknown vulnerabilities, and one of them still has no official fix. The Cybersecurity and Infrastructure Security Agency (CISA) is now pressing organizations to patch what they can and comb their networks for signs of intrusion, warning that standard detection tools may not catch the activity at all.
A quiet campaign with a long head start
The timeline here is the uncomfortable part. Ivanti reportedly identified a portion of the vulnerability chain months before it told customers anything, patching one component in a July release without publicly flagging the broader risk. By the time the company issued its security advisory on October 13th, a threat actor tracked as UTA0576 had already been active for roughly two weeks, according to researchers at Volexity, who first spotted the exploit chain in the wild. That gap between discovery and disclosure is a recurring tension in vulnerability management: companies often want a fix ready before going public, but delays can leave defenders blind while attackers operate freely.
How the attack works
The exploit chain combines an authentication bypass, remote code execution, and a privilege escalation flaw to give an attacker unauthenticated, root-level control over a fully patched device. What makes it particularly dangerous is the absence of malware or a web shell. Instead, the attacker reportedly re-exploits the device for every single command, running everything in memory and tampering with logs to erase evidence. That approach is specifically designed to slip past Ivanti's Integrity Checker Tool, which typically scans for file-based tampering rather than transient, memory-resident activity. One security researcher described the root cause as strikingly simple: a single crafted header value is enough to bypass authentication and reach functionality that should be locked down.
This kind of "living off the land" technique, where attackers avoid dropping persistent files, has become increasingly common against network edge devices precisely because it defeats conventional file-integrity monitoring. VPN gateways sit at the perimeter of corporate networks, authenticate remote users, and often hold elevated trust - which makes them an especially valuable target once compromised.
Patch now, but don't stop there
Ivanti has released updates for the authentication bypass vulnerability, now listed in CISA's Known Exploited Vulnerabilities catalog, but the privilege escalation flaw that completes the chain remains unpatched. That leaves organizations in an awkward position: applying the available fix closes one door but not the full attack path. CISA is urging network and memory forensics rather than relying solely on built-in integrity checks, and recommends specifically reviewing inbound traffic for a particular manipulated header associated with the exploit.
- Affected appliance versions include Connect Secure 25.1.1.1 and earlier, 25.1.2.2 and earlier, and 22.8R2.4 and earlier.
- Apply available patches immediately and prepare to deploy the remaining fix once released.
- Conduct memory and network forensics rather than relying only on the Integrity Checker Tool.
- Review logs and traffic history for anomalous headers or signs of tampering, since attackers reportedly altered logs to cover their tracks.
A familiar target, a widening pattern
Ivanti Connect Secure and its predecessor, Pulse Connect Secure, have a long history as targets for espionage groups and ransomware operators alike. This incident adds a 15th vulnerability to the CISA Known Exploited Vulnerabilities list tied to this product line, underscoring how persistently attractive remote-access gateways remain to attackers. Security researchers warn that exploitation of this kind typically starts narrow and targeted before expanding into broad, automated attacks once technical details circulate more widely. For organizations still running exposed appliances, the window between quiet, selective compromise and mass exploitation can close fast.