Ivanti patches two zero-days under attack, but finds another

Ivanti has disclosed multiple critical vulnerabilities in its Connect Secure VPN product, including recently discovered zero-days that allow privilege escalation and server-side authentication bypass. Security firms (Volexity, Mandiant) and government bodies (BSI, CISA) report active, targeted exploitation—attributed in part to Chinese state-backed actors—with thousands of appliances compromised and mitigations being bypassed; Ivanti has released staggered patches and recommends factory resets prior to patching to remove persistent access.