The device admitting people to the network was itself accessible to an attacker who needed no account. For the administrator responsible for Ivanti Connect Secure, the virtual private network appliance became the entry point.

Volexity said on October 13 that an attacker chained three previously unknown vulnerabilities to run commands as root without logging in. Root gives control of the appliance. One flaw remains unpatched.

The authentication boundary never stopped this attacker. There was no account to disable.

The Wang Report’s CVE Intel feed recorded zero additions to CISA’s Known Exploited Vulnerabilities catalogue among our tracked flaws in the seven days to October 13. Volexity nevertheless reported exploitation of Ivanti Connect Secure. Separately, Cyber Security News reported CISA’s warning that two Citrix NetScaler zero-days were under active exploitation.

Our count describes our tracked list. It cannot clear either appliance.

That matters to the person deciding whether the remote-access service can remain reachable while a complete fix is unavailable. A catalogue addition is a useful signal; its absence supplies no evidence that an exposed device is safe.

The control that acts before this reported chain is a restriction on who can reach Ivanti Connect Secure at all, enforced outside the appliance. For excluded sources, the request never reaches the vulnerable device.