Attacker Chains Three Ivanti Connect Secure Zero-Days for Root Access, Only Two Patched So Far
Three Ivanti Connect Secure zero-days chained for root access; two patched, one pending.
Run Ivanti?
Get an email when a reviewed story names Ivanti, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
Summary
Attackers are chaining three zero-day vulnerabilities in Ivanti Connect Secure VPN appliances to gain root access. Security firm Volexity discovered the exploit, which allows attackers to run commands without logging in. Ivanti has released patches for two of the three flaws, urging immediate action, while a fix for the third is still pending. The threat actor, tracked as UTA0576, has been observed exploiting these vulnerabilities in the wild, leading to credential theft and password spraying attacks.
The lesson from this incident
Full lessonThreat actor UTA0576 exploited three chained zero-day vulnerabilities in Ivanti Connect Secure VPN appliances, achieving unauthenticated root-level command execution — one of the most severe possible outcomes for an internet-facing device. The attack chain demonstrates how unpatched, perimeter-facing appliances can serve as a direct gateway to internal networks and credential stores. With one of the three flaws still unpatched, organizations remain exposed even after applying available fixes. This incident highlights how VPN gateways, trusted precisely because they control access, become high-value targets that demand accelerated patch cycles and compensating controls when patches are unavailable.
What helps against this
How we list vendors
- Vulnerability scanning and prioritisation
You know which systems are vulnerable, and which ones to fix first.
- Automated patch management
Known holes get closed in days, not months.
- Endpoint detection and response (EDR and XDR)
Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.
Indicators of Compromise
- cve — CVE-2026-104935
- cve — CVE-2026-106042
- cve — CVE-2026-109412
- ip — 108.165.147.64