Attacker Chains Three Ivanti Connect Secure Zero-Days for Root Access, Only Two Patched So Far
Attackers chained three Ivanti Connect Secure zero-days for root access; one privilege-escalation flaw remains unpatched.
Volexity said attacker UTA0576 chained three Ivanti Connect Secure zero-days to run commands as root without authentication, starting October 3 on one fully patched 22.8R2.4 appliance. CVE-2026-104935, rated CVSS 8.6, covers the authentication bypass and remote code execution; the privilege-escalation flaw remains unpatched. The attacker stole stored LDAP credentials, searched Active Directory, and password-sprayed accounts while evading Ivanti's Integrity Checker Tool. Ivanti reported limited exploitation, and CISA marked it active with total technical impact. Separate CVSS 9.9 flaws CVE-2026-106042 and CVE-2026-109412 in Xtraction and Neurons Patch for Intune are not known to be exploited.