Ivanti's VPN fell to a three-flaw chain on fully patched boxes. One flaw has no fix.
By Lior AharonovFounder, 7IT Solutions ·
On Tuesday 13 October 2026 Ivanti warned of CVE-2026-104935 in Connect Secure, and CISA added it to its exploited list the same day with a 16 October due date. Volexity says a group it tracks as UTA0576 chained three zero-days for root code execution, from at least 3 October. Two flaws are fixed in 22.8R2.5, 25.1.1.2, 25.1.3.0 and 25.1.3.1; SecurityWeek reports the privilege escalation is still unpatched.
Your VPN gateway holds domain credentials and sits between the internet and your internal network. Volexity says the attackers went after them and hunted for LAPS passwords and BitLocker keys. Patched is not the same as safe here.
If you run Ivanti Connect Secure, upgrade to a fixed version today, run Ivanti's Integrity Checker, and review appliance logs back to 3 October. Volexity says the attackers tampered with logs, so a clean log is not proof.
A gateway that needs a perfect patch record and still falls is a bet against yourself. Know your plan for the day it does.
Lior Aharonov · my takeSources
- BleepingComputer: Ivanti warns of Connect Secure zero-day exploited in attacks bleepingcomputer.com
- SecurityWeek: Ivanti Zero-Day Chain Gave Attackers Root Access to Fully Patched VPN securityweek.com
- CISA Known Exploited Vulnerabilities catalog (CSV feed) raw.githubusercontent.com
Researched with AI tools; every fact is checked against the linked sources.