Ivanti Connect Secure zero-days reportedly exploited in the wild for unauthenticated root access
- Status
- Unverified: only social posts report this so far
- Kind
- Vulnerability
- Vendor
- Ivanti
- Product
- Ivanti Connect Secure
- First seen
Summary
A threatintel.cc post reports that attackers are chaining zero-day flaws in Ivanti Connect Secure VPN appliances to gain unauthenticated root access. The item says this exposes stored credentials, and it does not name the flaws or CVE IDs.
If you use Ivanti
Check Ivanti's security advisories for patches and mitigations
Apply vendor fixes to Connect Secure appliances as soon as they are available
Hunt for signs of compromise and rotate credentials stored on the appliance
Check Ivanti's advisories for affected versions and apply any released patches or mitigations.
Review Connect Secure logs for signs of unauthorized access or new administrative accounts.
Restrict access to the management interface and VPN gateway until patched.
What the sources say 5
· Mastodon: “Ivanti Connect Secure 22.8R2.4 mishandles the manner in which the dsinvoked broker trusts DSCache configuration data, leading to privilege escalation to root, as exploited in the wild in October 2026.” Source
· Mastodon: “This Ivanti Connect Secure zero-day chain with CVE-2026-104935 is actively exploited in the wild.” Source
· Bluesky: “Attackers are chaining zero-day flaws in Ivanti Connect Secure VPN appliances to gain unauthenticated root access, exposing stored cr...” Source
· Bluesky: “Ivanti Connect Secure 0-Days Exploited in the Wild to Gain Unauthenticated Root Access” Source
· Mastodon: “For the last weekday of Cybersecurity Awareness Month, CISA added more CVEs to the KEV Catalog on a Friday :)” Source