Ivanti VPN zero-days chained for root access, one flaw remains unpatched

On October 13, 2026, cybersecurity firm Volexity disclosed that an attacker chained three zero-day vulnerabilities in Ivanti Connect Secure VPN appliances. The attack, attributed to a threat actor tracked as UTA0576, allowed unauthorized root-level command execution on a fully patched system as early as October 3. Ivanti has released patches for the authentication bypass and remote code execution flaws, tracked together as CVE-2026-104935. However, the third vulnerability in the chain, a privilege escalation flaw, remains unpatched as of the disclosure. The company advises customers on affected versions to upgrade immediately due to limited active exploitation.