CyberSecurity News

Ivanti Zero-Day Chain Gave Attackers Root Access to Fully Patched VPN

SecurityWeek

· October 13, 2026

AI summary

A zero-day vulnerability in Ivanti Connect Secure, identified as CVE-2026-104935, allows for unauthenticated remote code execution with elevated privileges. This flaw can be exploited to gain root access, even on fully patched VPN systems. The vulnerability affects Ivanti Connect Secure, providing attackers with a means to execute code remotely without authentication.

Vulnerabilities mentioned

CVE-2026-104935

HIGH

CVSS 8.6

Authentication bypass by spoofing in ICS before version 25.1.3.0 allows a remote unauthenticated attacker to execute arbitrary commands. This does not impact ICS version 22.7R2.14 or prior.

Read the full article at SecurityWeekwww.securityweek.com/ivanti-zero-day-chain-gave-attackers-root-access-to-fully-patched-vpn/

This is an AI-generated brief aggregated by HackerFeeds for convenience and grounded in the source’s own summary; the related CVE, threat-group and country data is from HackerFeeds’ own indexes. The original article is the authoritative source — all rights belong to SecurityWeek.