Ivanti Zero-Day Chain Gives Attackers Root Access to Connect Secure VPN

· Cybersecurity · United States

An attacker chained three zero-day flaws in Ivanti Connect Secure, a widely deployed VPN appliance, to run commands as root without logging in, security firm Volexity reported on October 13. The campaign is tracked as CVE-2026-104935. Ivanti has released fixes for two of the three flaws and told customers on affected versions to "act immediately," but a patch for the third remains pending. The chain could be exploited for unauthenticated remote code execution with elevated privileges, meaning an attacker with network access to a vulnerable appliance could take full control. Because these appliances sit at the network edge, a successful compromise can open a path into the rest of the enterprise. Organizations running Ivanti Connect Secure are being urged to patch now and to hunt for signs of prior exploitation, since root access without authentication is difficult to detect after the fact.

Why it matters：Edge VPN appliances are a prime target for state-linked and ransomware actors, and an unpatched flaw here can hand attackers a persistent foothold inside an otherwise well-defended network.

Key points

  • Volexity reported the attack on October 13; three flaws were chained, two are patched.
  • Tracked as CVE-2026-104935, affecting Ivanti Connect Secure remote access gateways.
  • Ivanti told customers on affected versions to 'act immediately.'

Sources (original reporting)

More stories from this day