CONNECT WITH US
Cyber Security

Cyber Security

Attacker Chains Three Ivanti Connect Secure Zero-Days for Root Access, Only Two Patched So Far

The Hacker News logo

Published on

Add as a preferred source on Google
Attacker Chains Three Ivanti Connect Secure Zero-Days for Root Access, Only Two Patched So Far

An attacker chained three zero-day flaws in Ivanti Connect Secure, a VPN appliance, to run commands as root without logging in, security firm Volexity said on October 13. Ivanti has released fixes for two of the flaws and told customers on affected versions to "act immediately." A fix for the third is still pending, according to Volexity.

Volexity, which reported the flaws to Ivanti, found the attack on one customer's appliance. The appliance was fully patched at the time and running version 22.8R2.4. The attacker, which Volexity tracks as UTA0576, began exploiting it on October 3.

Ivanti said on October 13 that it is aware of "limited exploitation in the wild."

The first two flaws are an authentication bypass and a remote code execution flaw, tracked together as CVE-2026-104935. Together they let an attacker run code as the appliance's cgi-server user, and the third flaw, a privilege escalation, raises that to root, Volexity said.

The CVE record Ivanti filed shows which Connect Secure versions are affected:

Ivanti's security advisory has more on the affected versions and the fixes.

The release notes for 25.1.3.0 are dated July 2026. Customers already on that version are outside the range the CVE record gives.

Ivanti is working on a fix for the privilege escalation flaw, which will come "in a future release in the coming weeks," Volexity said. Its report does not say what risk that flaw carries on an appliance where the first two are fixed.

Ivanti tells customers to upgrade and to run its Integrity Checker Tool regularly.


Source link
Related Topics:Cyber Security

Disclaimer

We strive to uphold the highest ethical standards in all of our reporting and coverage. We TheMorningPulse.fyi want to be transparent with our readers about any potential conflicts of interest that may arise in our work. It's possible that some of the investors we feature may have connections to other businesses, including competitors or companies we write about. However, we want to assure our readers that this will not have any impact on the integrity or impartiality of our reporting. We are committed to delivering accurate, unbiased news and information to our audience, and we will continue to uphold our ethics and principles in all of our work. Thank you for your trust and support.