Ivanti patches two more Connect Secure zero-days chained in attacks

What happened?

Ivanti released security updates to patch two more Connect Secure (ICS) remote access gateway flaws that have been chained in zero-day attacks since at least October 1. [...]

Key details

• Ivanti released patches for two Connect Secure zero-day flaws chained in attacks since October 1.
• The two new flaws are a privilege escalation bug and an authenticated file upload vulnerability.
• Threat actor UTA0576 chained the authentication bypass with two other flaws for unauthenticated root code execution.
• The attacker re-exploited the device for each command and tampered with logs to evade detection.
• CISA added the authentication bypass to its exploited vulnerabilities catalog and ordered federal agencies to patch by Friday.
• Shadowserver tracks over 5,000 Internet-exposed ICS instances with unknown patch status.
• Ivanti has had 38 vulnerabilities flagged by CISA as actively exploited since November 2021.

Summarised by SecOraLens from BleepingComputer. Always read the original source before acting. How SecOraLens verifies advisories.