Office VPN gateways are being taken over.

What's happening.

Ivanti Connect Secure is a VPN gateway that lets staff reach the office network from home. Three flaws can be chained. One lets an attacker with no login run commands on the gateway. One lets a logged-in attacker upload files to a known place. One lets them raise their access to the highest level on the device.

CISA says Ivanti's own Integrity Checker Tool may miss this attack, because the attacker's commands run in memory and leave little on disk.

What it means for you.

A VPN gateway sits on the edge of your network. Whoever controls it can read what passes through, steal staff logins and move on to file servers, email and backups.

A clean result from the Integrity Checker does not prove you are safe. CISA says proving you were not compromised needs network and memory forensics.

How to fix it.

1. Update to the fixed release in Ivanti's advisory. NVD lists 25.1.3.0 for the authentication bypass, and 25.1.1.3 and 22.8R2.6 for the file upload flaw.
2. Do this first for any gateway reachable from the internet.
3. If the gateway was unpatched while exposed, treat it as possibly compromised. Reset the passwords and certificates that pass through it, and get specialist help to check it. Do not rely on the Integrity Checker alone.
4. Ask your IT provider whether you run Connect Secure. If you do not know, ask who runs your VPN.