Ivanti Zero-Day Chain Gave Attackers Root Access to Fully Patched VPN

Full Analysis

A newly discovered zero-day vulnerability, CVE-2026-104935, in Ivanti Connect Secure allows attackers to gain unauthenticated remote code execution with elevated privileges. This flaw poses a significant risk, especially as it affects fully patched VPN systems, potentially compromising sensitive enterprise data. The ability for attackers to obtain root access underscores the urgency for organizations relying on Ivanti's solutions to reassess their security posture. Technical details indicate that the vulnerability can be exploited without authentication, making it particularly dangerous for enterprises that may believe their systems are secure due to recent patches. The implications of this vulnerability extend beyond immediate access; it can lead to further exploitation of internal networks, data breaches, and operational disruptions. IT leaders should prioritize immediate action by reviewing their current Ivanti deployments and implementing necessary security measures. This includes monitoring for unusual activity, applying any available patches, and considering additional layers of security to mitigate potential exploitation of this vulnerability.