Ivanti Connect Secure Zero-Day Chain Enables Root-Level Compromise

Three zero-day vulnerabilities in Ivanti Connect Secure VPN appliances have been chained by an attacker to achieve unauthenticated root-level access on a fully patched device. CISA has added the primary flaw to its Known Exploited Vulnerabilities catalog. A partial patch is available; a fix for the privilege escalation component remains pending.

Security firm Volexity reported on October 13, 2026, that an attacker tracked as UTA0376 began exploiting Ivanti Connect Secure VPN appliances on October 3. The attack chains CVE-2026-104935 — an authentication bypass combined with remote code execution, rated 8.6 — with an unpatched privilege escalation vulnerability to gain root access without authentication.

The attacker operated entirely in memory, restoring modified configuration data after each session and deploying no persistent backdoor or web shell. This technique caused Ivanti's Integrity Checker Tool to miss the compromise. Stolen material included LDAP domain credentials; the attacker subsequently conducted password-spraying attacks against Active Directory.

Ivanti has released fixes for the authentication bypass and remote code execution components and advises customers on affected versions to upgrade immediately. Connect Secure versions 25.1.3.0, 25.1.3.1, and 22.8R2.5 are unaffected by the patched components. A fix for the privilege escalation flaw is expected in a forthcoming release.

ivanti.com — AEO Score: 62.36 / D

One adverse signal noted from a single source without corroboration across independent sources reviewed.