Photo credits
Hackers Exploit Vulnerability in Ivanti Connect Secure to Gain Root Access
A chain of three high‑severity flaws was used to bypass authentication and run root commands on the popular VPN appliance, prompting a patch advisory and a warning from U.S. federal agencies.
14 Oct 2026 0 reads Compiled with AI
Cybersecurity researchers have uncovered a sophisticated attack that uses a chain of three high‑severity flaws to gain root access on Ivanti Connect Secure devices.
The chain starts with an authentication‑bypass vulnerability that lets a remote attacker spoof login signals and bypass normal checks, then exploits a remote‑code‑execution flaw and a privilege‑escalation bug to reach the system’s root account.
After gaining root, the threat actor targets secrets stored in the network, such as Active Directory credentials, BitLocker recovery keys and the Local Administrator Password Solution, using a custom LDAP tool and a custom Kerberos tool for Kerberoast attacks.
Volexity first noticed unusual authentication failures on an Ivanti customer on October 5, after having detected suspicious activity on the vendor’s own honeypots on October 1, and traced the attacks back to October 3.
Ivanti had patched the vulnerability in its July 25.1.3.0 release, but the flaw was still exploitable in earlier and some later supported versions, prompting the company to issue additional fixes for 22.8R2.5, 25.1.1.2, 25.1.3.0 and 25.1.3.1.
The U.S. Cybersecurity and Infrastructure Security Agency added CVE‑2026‑104935 to its Known Exploited Vulnerabilities catalog on October 13 and urged federal civilian agencies to patch by Friday, warning that the Integrity Checker Tool may miss in‑memory commands and that attackers delete evidence from logs.