Ivanti Zero-Day Chain Gave Attackers Root Access to Fully Patched VPN
Summary
A chain of zero-day vulnerabilities affecting Ivanti Connect Secure has been discovered, allowing unauthenticated remote code execution with elevated privileges. This exploit chain reportedly granted attackers root access even to fully patched VPN systems.
IFF Assessment
The discovery of a zero-day exploit chain that grants attackers root access to critical VPN infrastructure poses a significant threat to defenders.
Severity
CISA KEV: Listed as actively exploited. Federal patch due: October 16, 2026. Known ransomware use: Unknown.
Defender Context
This incident highlights the critical need for continuous monitoring and rapid patching, even for systems believed to be up-to-date. Defenders should be particularly vigilant about Ivanti Connect Secure devices and any signs of compromise, as this zero-day chain offers attackers significant access.