Ivanti Zero-Day Chain Gave Attackers Root Access to Fully Patched VPN
BLUF
Ivanti Connect Secure is exposed to a critical zero-day chain that can give attackers full control even after patching.
NEWS
CVE-2026-104935 affects Ivanti Connect Secure and enables unauthenticated remote code execution with elevated privileges. The reported exploitation chain allowed attackers to obtain root access on systems believed to be fully patched.
Why I Care
Ivanti Connect Secure appliances are often internet-facing entry points for enterprise networks, so compromise can lead to credential theft, persistent access, lateral movement, and broad network exposure. The fact that patched systems could still be exploited raises the risk for organizations relying on standard patch cycles alone.
Next Steps
Ivanti Connect Secure administrators should immediately review vendor advisories, apply any available mitigations or emergency updates, isolate affected appliances if feasible, hunt for indicators of compromise and anomalous admin activity, rotate credentials and certificates where appropriate, and escalate to incident response if signs of exploitation are found.
Source: Security Week ·