An attacker exploited three Ivanti Connect Secure zero-days to run commands as root and steal stored credentials from one appliance.