VulnHub

Real-time Cybersecurity News

Critical

Attacker Chains Three Ivanti Connect Secure Zero-Days for Root Access, Only Two Patched So Far

The Hacker News
Actively Exploited
Zero-dayVulnerabilityPatchCritical

Overview

On October 13, security firm Volexity reported that an attacker exploited three zero-day vulnerabilities in Ivanti Connect Secure, a VPN appliance, allowing them to execute commands with root access without needing to log in. Ivanti has acknowledged the issues and released patches for two of the vulnerabilities, urging customers using affected versions to act immediately. However, a fix for the third vulnerability is still pending. This situation is critical as it exposes users to potential unauthorized access and control over their systems, raising significant security concerns for organizations relying on this VPN service. Companies must ensure they apply the available patches and stay vigilant for updates regarding the remaining flaw.

Key Takeaways

  • Active Exploitation: This vulnerability is being actively exploited by attackers. Immediate action is recommended.
  • Affected Systems: Ivanti Connect Secure VPN appliance, specific versions not specified
  • Action Required: Patches available for two vulnerabilities; customers should apply immediately.
  • Timeline: Disclosed on October 13, 2023

Original Article Summary

An attacker chained three zero-day flaws in Ivanti Connect Secure, a VPN appliance, to run commands as root without logging in, security firm Volexity said on October 13. Ivanti has released fixes for two of the flaws and told customers on affected versions to "act immediately." A fix for the third is still pending, according to Volexity. Volexity, which reported the flaws to Ivanti,

Impact

Ivanti Connect Secure VPN appliance, specific versions not specified

Exploitation Status

This vulnerability is confirmed to be actively exploited by attackers in real-world attacks. Organizations should prioritize patching or implementing workarounds immediately.

Timeline

Disclosed on October 13, 2023

Remediation

Patches available for two vulnerabilities; customers should apply immediately. Third vulnerability fix pending.

Additional Information

This threat intelligence is aggregated from trusted cybersecurity sources. For the most up-to-date information, technical details, and official vendor guidance, please refer to the original article linked below.

Related Topics: This incident relates to Zero-day, Vulnerability, Patch, and 1 more.

Read Original Article

Related Coverage

Ghostscript flaw lets hackers hijack servers via PDF uploads

BleepingComputer

A serious vulnerability has been discovered in the Ghostscript interpreter, identified as CVE-2026-39919. This flaw allows attackers to exploit a heap buffer overflow, which could lead to remote code execution if they upload specially crafted PDF files. This vulnerability poses a significant risk to any servers running the Ghostscript software, as it could enable unauthorized access and control. Organizations using Ghostscript need to be particularly vigilant, as the potential for exploitation could result in severe data breaches or system compromises. It's crucial for users to stay updated on this issue to protect their systems from potential attacks.

Oct 13, 2026

UK Housing Ombudsman Service investigates 'security incident'

BleepingComputer

The U.K. Housing Ombudsman Service is currently looking into a security incident involving a third-party IT service that affected its case management system on Tuesday. This incident raises concerns about the safety of sensitive information managed by the Ombudsman, which handles housing disputes for residents. While details on the exact nature of the incident are still emerging, the investigation aims to determine the impact on users and how to secure the system moving forward. Such breaches can undermine public trust in governmental services, especially those dealing with personal and sensitive matters. The situation is being monitored closely to ensure that necessary measures are taken to protect data integrity and user privacy.

Oct 13, 2026

Docker Fixes Critical Two-Year-Old Hub Flaw That Let One User Push Images as Another

The Hacker News

Docker recently addressed a significant security flaw in its Docker Hub service, which is used for publishing and downloading container images. This vulnerability, present for nearly two years, allowed one user to push, pull, or delete images under another user's account. Docker released a fix for the issue on September 30 and confirmed on October 12 that there was no evidence of exploitation. The problem stemmed from a feature that changed personal accounts into organization accounts, which created a loophole for unauthorized actions. This incident raises concerns about the security of user accounts on platforms that handle sensitive software components, emphasizing the need for vigilant security practices.

Oct 13, 2026

SAP Discloses Critical CVSS 10 Flaw in Cloud SDK for Python Allowing OAuth2 Credential Theft

The Hacker News

SAP has announced a serious vulnerability in its Cloud SDK for Python, which could allow attackers to steal OAuth2 client credentials from applications running on the SAP Business Technology Platform (BTP). This flaw, rated with a CVSS score of 10, affects multi-tenant applications that utilize the SDK. For an attacker to exploit this vulnerability, they must have control over the tenant subdomain, making it crucial for users to ensure their subdomains are secure. The potential for credential theft poses significant risks to organizations using these services, as compromised credentials could lead to unauthorized access and data breaches. Companies using the affected SDK should take immediate action to assess their security posture and implement necessary safeguards.

Oct 13, 2026

TFG London cyberattack disrupts systems at Hobbs and Whistles retailers

BleepingComputer

TFG London has reported a cybersecurity incident affecting its IT systems, particularly those used by its premium fashion brands, including Phase Eight, Hobbs, and Whistles. As a result of this attack, operations at these retailers have been disrupted. The exact nature of the incident hasn't been detailed, but the impact on the brands could lead to significant operational challenges, affecting their ability to serve customers effectively. This incident raises concerns about the security measures in place at fashion retailers and the potential risks they face from cyber threats. It's crucial for companies in this sector to assess their cybersecurity protocols to prevent future incidents.

Oct 13, 2026

Ivanti warns of Connect Secure zero-day exploited in attacks

BleepingComputer

Ivanti has issued a warning regarding a zero-day vulnerability in its Connect Secure (ICS) remote access gateway that is currently being exploited by attackers. This flaw allows unauthorized access to sensitive systems, putting organizations at risk. Ivanti is urging customers to implement patches immediately to protect their systems from potential intrusions. The vulnerability affects users of the Ivanti Connect Secure product, which is widely used for secure remote access. Given the nature of the vulnerability and its active exploitation, it’s crucial for affected organizations to act swiftly to mitigate any potential damage and secure their networks.

Oct 13, 2026