Ivanti Connect Secure Zero-Day Chain Enables Unauthenticated Root Access; Third Fix Pending

Summary

Volexity reports an attacker chained three Ivanti Connect Secure zero-days for unauthenticated root access. Ivanti says exploitation is limited; fixes are available for two flaws, while the third remains unpatched.

Key points

Volexity found the chain being used against one customer’s fully patched Connect Secure appliance, running version 22.8R2.4; exploitation began October 3.
An authentication bypass and remote code execution flaw, tracked together as CVE-2026-104935, allow code execution as the appliance’s cgi-server user; a third privilege-escalation flaw raises access to root.
Ivanti says it is aware of limited exploitation in the wild. CISA marks CVE-2026-104935 as actively exploited with total technical impact.
Ivanti has released fixes for the first two flaws and urges customers on affected versions to act immediately. A fix for the privilege-escalation flaw is expected in a future release in the coming weeks.
Volexity says its Integrity Checker Tool misses this exploit chain because the attacker changes library code in memory and restores altered configuration data; it recommends forensic investigation, including network and memory forensics, to confirm compromise.
In the investigated incident, the attacker stole stored credentials, searched Active Directory for passwords, and conducted password-spraying attacks. Volexity found no backdoor or web shell.
The companies did not say how many customers were attacked or provide a temporary workaround for customers unable to upgrade; the article also notes separate fixes for Xtraction and Neurons Patch for Intune flaws.

Article Details

Vulnerability Types: Authentication bypass
Remote code execution
Privilege escalation
Severity: 8.6/10 for CVE-2026-104935, according to Ivanti
Affected Versions: Xtraction before version 2026.4
Exploitation Status: active
Exploit Availability: unknown
Patch Status: partial