Ivanti patches two flaws after attacker chains three zero-days

An attacker combined three Connect Secure vulnerabilities to execute commands as root without logging in, The Hacker News reports, citing Volexity. Ivanti urged affected customers to patch immediately, but a fix for the third flaw remains pending, according to the same report. The attacks targeted the company's remote access gateway.

• Cyber Security News reports CVE-2026-104935 has a CVSS score of 8.6.
• CISA added the flaw to its exploited vulnerabilities catalog, according to Security Affairs.

Covered by 5 publishers within 3 hours of the first report.

• The Hacker News: Attacker Chains Three Ivanti Connect Secure Zero-Days for Root Access, Only Two Patched So Far

Reporting5

BC BleepingComputer Ivanti warns of Connect Secure zero-day exploited in attacks · Sergiu Gatlan 11:45 AM

CSN Cyber Security News Ivanti Connect Secure 0-Day Vulnerability Actively Exploited in the Wild · Guru Baran 11:55 AM

THN The Hacker News Attacker Chains Three Ivanti Connect Secure Zero-Days for Root Access, Only Two Patched So Far · info@thehackernews.com (The Hacker News) 1:33 PM

SAF Security Affairs U.S. CISA adds Ivanti Connect Secure flaw to its Known Exploited Vulnerabilities catalog · Pierluigi Paganini 2:14 PM

SW SecurityWeek Ivanti Zero-Day Chain Gave Attackers Root Access to Fully Patched VPN · Eduard Kovacs 2:43 PM

Related

SAF AI Agent Chains Zammad Zero-Days To Take Over DIVD Systems in Seconds September 30

CS Citrix discloses a third exploited NetScaler zero-day within a week October 4

THN Warlock Exploits SharePoint Flaws to Disable Security Tools and Deploy Ransomware October 2

THN Cisco Warns of Attackers Exploiting Critical Authentication Bypass in SD-WAN Manager September 30

Topics Zero-day vulnerabilities