Attacker Chains Three Ivanti Connect Secure Zero-Days for Root Access, Only Two Patched So Far
An attacker chained three zero-day flaws in Ivanti Connect Secure, a VPN appliance, to run commands as root without logging in, security firm Volexity said on October 13.
An attacker chained three zero-day flaws in Ivanti Connect Secure, a VPN appliance, to run commands as root without logging in, security firm Volexity said on October 13.
Ivanti has also patched several other Connect Secure zero-days exploited in the wild over the past several years, some of them chained in widespread attacks to deploy malware .
Ivanti urged customers on Tuesday to immediately patch an actively exploited zero-day vulnerability in the Ivanti Connect Secure (ICS) remote access gateway.
Volexity, which reported the flaws to Ivanti, found the attack on one customer's appliance.
Cybersecurity and Infrastructure Security Agency (CISA) marks exploitation as "active" and the technical impact as "total." Separately, the same Ivanti post covers fixes for two other products, Xtraction and Neurons Patch for Intune, and Ivanti said it is not aware of those flaws being exploited.
Ivanti has released fixes for two of the flaws and told customers on affected versions to "act immediately." A fix for the third is still pending, according to Volexity.
Together they let an attacker run code as the appliance's cgi-server user, and the third flaw, a privilege escalation, raises that to root, Volexity said.
Hackers have frequently exploited Ivanti vulnerabilities, often as zero-days, because they provide a quick way to breach enterprise networks and steal sensitive customer and corporate data.
Ivanti said on October 13 that it is aware of "limited exploitation in the wild." The first two flaws are an authentication bypass and a remote code execution flaw, tracked together as CVE-2026-104935 .
The Cybersecurity and Infrastructure Security Agency (CISA) has flagged 36 vulnerabilities across various Ivanti products as actively exploited in the wild since November 2021, 12 of which ransomware gangs have also abused.
What happened
An attacker chained three zero-day flaws in Ivanti Connect Secure, a VPN appliance, to run commands as root without logging in, security firm Volexity said on October 13.
Ivanti has also patched several other Connect Secure zero-days exploited in the wild over the past several years, some of them chained in widespread attacks to deploy malware .
What changed
Ivanti urged customers on Tuesday to immediately patch an actively exploited zero-day vulnerability in the Ivanti Connect Secure (ICS) remote access gateway.
Volexity, which reported the flaws to Ivanti, found the attack on one customer's appliance.
Who is affected
Cybersecurity and Infrastructure Security Agency (CISA) marks exploitation as "active" and the technical impact as "total." Separately, the same Ivanti post covers fixes for two other products, Xtraction and Neurons Patch for Intune, and Ivanti said it is not aware of those flaws being exploited.
Ivanti has released fixes for two of the flaws and told customers on affected versions to "act immediately." A fix for the third is still pending, according to Volexity.
Why it matters
Together they let an attacker run code as the appliance's cgi-server user, and the third flaw, a privilege escalation, raises that to root, Volexity said.
Hackers have frequently exploited Ivanti vulnerabilities, often as zero-days, because they provide a quick way to breach enterprise networks and steal sensitive customer and corporate data.
Technical details
Ivanti said on October 13 that it is aware of "limited exploitation in the wild." The first two flaws are an authentication bypass and a remote code execution flaw, tracked together as CVE-2026-104935 .
The Cybersecurity and Infrastructure Security Agency (CISA) has flagged 36 vulnerabilities across various Ivanti products as actively exploited in the wild since November 2021, 12 of which ransomware gangs have also abused.
Cybersecurity firm Volexity, which found and reported the flaw, revealed earlier today that a previously unknown threat actor it tracks as UTA0576 has chained the CVE-2026-104935 vulnerability since at least October 3 with two other flaws to achieve unauthenticated root-level code execution on fully patched devices.
Response
The CVE record Ivanti filed shows which Connect Secure versions are affected: Ivanti's security advisory has more on the affected versions and the fixes.
Ivanti is working on a fix for the privilege escalation flaw, which will come "in a future release in the coming weeks," Volexity said.
What security teams should do
The appliance was fully patched at the time and running version 22.8R2.4.
Each has a flaw Ivanti rates 9.9 out of 10: CVE-2026-106042 in Xtraction before version 2026.4, and CVE-2026-109412 in Neurons Patch for Intune.
What remains unknown
Cybersecurity firm Volexity, which found and reported the flaw, revealed earlier today that a previously unknown threat actor it tracks as UTA0576 has chained the CVE-2026-104935 vulnerability since at least October 3 with two other flaws to achieve unauthenticated root-level code execution on fully patched devices.
Attribution
The Hacker News: An attacker chained three zero-day flaws in Ivanti Connect Secure, a VPN appliance, to run commands as root without logging in, security firm Volexity said on October 13.
BleepingComputer: Ivanti urged customers on Tuesday to immediately patch an actively exploited zero-day vulnerability in the Ivanti Connect Secure (ICS) remote access gateway.
What to watch next
Watch for new exploitation reports and updated indicators of compromise.
Watch for updated vendor guidance and fixed-version details.