Attackers Chained Three Ivanti Zero-Days to Gain Root on Fully Patched VPN Appliances

Hackers Chain 3 Ivanti VPN Zero-Days to Gain Root Access Without Authentication

Attackers chained three zero-day vulnerabilities in Ivanti Connect Secure (ICS) VPN appliances to execute commands as root without authentication, then… Read more →

Attackers chained three Ivanti zero-days to gain root on fully patched VPN appliances

A threat actor has been using an exploit chain combining three vulnerabilities in Ivanti’s Connect Secure (ICS) appliances to breach organizations, collect credentials, exfiltrate configuration data, and perform network reconnaissance. “In the first week of October 2026, Volexity discovered an unknown threat actor, UTA0576, abusing a zero-day exploit chain to compromise a fully patched (at the time, version 22.8R2.4) Ivanti Connect Secure (ICS) …

Attackers chain three Ivanti VPN zero-days for root access

One of the flaws awaits fix.

Ivanti Zero-Day Chain Gave Attackers Root Access to Fully Patched VPN

CVE-2026-104935 affects Ivanti Connect Secure and it can be exploited for unauthenticated remote code execution with elevated privileges.

Attacker Chains Three Ivanti Connect Secure Zero-Days for Root Access, Only Two Patched So Far

An attacker chained three zero-day flaws in Ivanti Connect Secure, a VPN appliance, to run commands as root without logging in, security firm Volexity said on October 13. Ivanti has released fixes for two of the flaws and told customers on affected versions to "act immediately." A fix for the third is still pending, according to Volexity. Volexity, which reported the flaws to Ivanti,