{"id":3515,"date":"2026-10-13T21:46:53","date_gmt":"2026-10-13T21:46:53","guid":{"rendered":"https:\/\/thedigitalfortress.us\/?p=3515"},"modified":"2026-10-13T21:46:53","modified_gmt":"2026-10-13T21:46:53","slug":"attacker-chains-three-ivanti-connect-secure-zero-days-for-root-access-only-two-patched-so-far","status":"publish","type":"post","link":"https:\/\/thedigitalfortress.us\/?p=3515","title":{"rendered":"Attacker Chains Three Ivanti Connect Secure Zero-Days for Root Access, Only Two Patched So Far"},"content":{"rendered":"
\n

\ue804<\/i>Swati Khandelwal<\/span>\ue802<\/i>Oct 13, 2026<\/span><\/span>Vulnerability \/ Enterprise Security<\/span><\/p>\n<\/div>\n

\n
<\/a><\/div>\n

An attacker chained three zero-day flaws in Ivanti Connect Secure, a VPN appliance, to run commands as root without logging in, security firm Volexity said<\/a> on October 13. Ivanti has released fixes for two of the flaws and told customers on affected versions to \u00abact immediately.\u00bb A fix for the third is still pending, according to Volexity.<\/p>\n

Volexity, which reported the flaws to Ivanti, found the attack on one customer’s appliance. The appliance was fully patched at the time and running version 22.8R2.4. The attacker, which Volexity tracks as UTA0576, began exploiting it on October 3.<\/p>\n

Ivanti said<\/a> on October 13 that it is aware of \u00ablimited exploitation in the wild.\u00bb<\/p>\n

The first two flaws are an authentication bypass and a remote code execution flaw, tracked together as CVE-2026-104935<\/a>. Together they let an attacker run code as the appliance’s cgi-server user, and the third flaw, a privilege escalation, raises that to root, Volexity said.<\/p>\n

\n
\"Cybersecurity\"<\/a><\/div>\n<\/div>\n

The CVE record Ivanti filed shows which Connect Secure versions are affected:<\/p>\n

<\/p>\n