Attacker Chains Three Ivanti Connect Secure Zero-Days for Root Access, Only Two Patched So Far
Summary: Volexity reported on October 13 that an attacker it tracks as UTA0576 chained three zero-day flaws in Ivanti Connect Secure to run commands as root without logging in, hitting a fully patched appliance running version 22.8R2.4 starting October 3. Ivanti has fixed two of the flaws - an authentication bypass and a remote code execution flaw tracked together as CVE-2026-104935, rated 8.6 on CVSS - while a fix for the third, a privilege escalation, is still pending.
What you should know: The appliance was fully patched when it was exploited, and Ivanti's Integrity Checker Tool misses the chain because the exploit alters library code only in memory and restores the configuration data it changes - so confirming a compromise takes network and memory forensics, not a scan.
Read the original at The Hacker News ↗
- Topics
- Vulnerabilities & Patching
- Mentions
- CVE-2026-104935CVE-2026-106042CVE-2026-109412
- Related
- CVE-2026-104935: Ivanti Connect Secure Authentication Bypass by Spoofing Vulnerability Known Exploited Vulnerabilities · Oct 13, 2026