Attacker Chains Three Ivanti Connect Secure Zero-Days for Root Access

On October 13, 2026, Volexity published analysis of an attack chain targeting Ivanti Connect Secure, a widely deployed VPN appliance. The actor chained three zero-day flaws to bypass authentication and attain root-level remote code execution on affected devices. Ivanti confirmed the vulnerabilities and stated that fixes for two of the three flaws are available. The company has advised customers on affected versions to "act immediately" by applying the released patches. However, a fix for the third vulnerability is still pending, leaving unpatched systems exposed to active exploitation in the wild. Volexity reported the flaws to Ivanti prior to public disclosure. The exact identity of the threat actor and the full scope of affected organizations have not been specified in the reported analysis. The chaining of multiple zero-days highlights the severity of the incident, as each flaw alone may not have granted the level of access achieved by the combined chain. Organizations running Ivanti Connect Secure are recommended to apply the available emergency patches and monitor for updates regarding the pending third fix.