Attacker Chains Three Ivanti Connect Secure Zero-Days for Root Access, Only Two Patched So Far

AI Summary

Volexity disclosed that an attacker chained three zero-day vulnerabilities in Ivanti Connect Secure VPN appliances to achieve unauthenticated root-level command execution. As of October 13, Ivanti has patched only two of the three flaws; CVE-2026-104935 enables unauthenticated RCE with elevated privileges. Ivanti is urging customers on affected versions to 'act immediately,' and a fix for the third zero-day remains pending.

Read full article → https://thehackernews.com/2026/10/attacker-chains-…

Relevance score: 94.0/100

# More from October 14

1
Microsoft Patches Record 1,413 Flaws, Including Exploited Windows Shell Bug The Hacker News
3
Attackers Heat French Supermarket Fridges Up to 50°C by Hijacking Danfoss Controllers The Hacker News
4
$86 Million Crypto Heist Linked to Ledger Signer Hardware Implant SecurityWeek
5
GitLab Patches CVSS 10.0 Flaw That Could Let Unauthenticated Users Run Server Code The Hacker News
6
DOJ charges 14 over a sprawling North Korean remote work scheme CyberScoop
7
Low-Cost Android Phones Ship With Preinstalled Malware That Turns Them Into Residential Proxies The Hacker News
8
SAP Discloses Critical CVSS 10 Flaw in Cloud SDK for Python Allowing OAuth2 Credential Theft The Hacker News
9
GitHub Tightens npm Publishing After Flaw Left 1,500+ Packages Vulnerable to Hijacking The Hacker News
10
OpenAI Employee Arrested for Allegedly Planting Hidden Recorder in Executive Conference Room The Hacker News