Attacker Chains Three Ivanti Connect Secure Zero-Days for Root Access, Only Two Patched So Far

What happened?

An attacker chained three zero-day flaws in Ivanti Connect Secure, a VPN appliance, to run commands as root without logging in, security firm Volexity said on October 13. Ivanti has released fixes for two of the flaws and told customers on affected versions to "act immediately." A fix for the third is still pending, according to Volexity. Volexity, which reported the flaws to Ivanti,

Key details

• An attacker chained three zero-day flaws in Ivanti Connect Secure to execute commands as root without authentication.
• Volexity discovered the exploitation on a fully patched appliance running version 22.8R2.4 starting October 3.
• The first two flaws combine as an authentication bypass and remote code execution tracked as CVE-2026-104935.
• The attacker stole LDAP credentials, searched Active Directory, and ran password-spraying attacks.
• The exploit operates only in memory and restores altered configuration, evading Ivanti's Integrity Checker Tool.

Summarised by SecOraLens from The Hacker News. Always read the original source before acting. How SecOraLens verifies advisories.