Attackers Chain Three Ivanti VPN Zero-Days for Root Access

Key takeaways

• Attackers chained three zero-day flaws in Ivanti Connect Secure to gain root access without authentication.
• Ivanti has patched two of the three vulnerabilities, but the third fix is still pending.
• A compromised VPN gateway can expose all traffic, credentials, and internal network access.
• Patching the available fixes immediately is critical, but does not eliminate risk until the third flaw is addressed.
• Manual log review and incident response are necessary because automated detection signatures are not yet available.

# Attackers Chain Three Ivanti VPN Zero-Days for Root Access

What Shipped

On October 13, security firm Volexity disclosed three zero-day vulnerabilities (https://thehackernews.com/2026/10/attacker-chains-three-ivanti-connect.html) in Ivanti Connect Secure, a widely deployed VPN appliance. Attackers successfully chained all three flaws together to execute commands as root without ever logging in.

Ivanti has released patches (https://www.bleepingcomputer.com/news/security/ivanti-warns-of-connect-secure-zero-day-exploited-in-attacks/) for two of the three vulnerabilities and urged customers on affected versions to "act immediately." A fix for the third flaw is still pending, according to Volexity's report (https://thehackernews.com/2026/10/attacker-chains-three-ivanti-connect.html).

Volexity discovered the chain during active exploitation and reported the flaws to Ivanti. The vulnerabilities affect Ivanti Connect Secure (ICS), a remote access gateway that businesses use to provide VPN access to employees and partners.

How It Works

The attack chain requires no authentication. An external attacker can exploit these flaws sequentially to escalate privileges from unauthenticated network access all the way to root control of the appliance.

While the technical details of each individual vulnerability have not been fully disclosed, the chain demonstrates a clear progression. The first flaw likely grants initial code execution or access. The second escalates privileges within the system. The third delivers root level control.

This type of chained exploit is particularly dangerous because it removes all barriers between the public internet and full administrative control. The attacker does not need stolen credentials, insider access, or social engineering. They simply need to reach the VPN appliance over the network.

Root access on a VPN gateway means an attacker can monitor all traffic passing through the device, harvest credentials, modify configurations, deploy backdoors, and pivot into the internal network behind the VPN.

What It Changes for Builders

If you manage Ivanti Connect Secure appliances, this is a drop-everything moment.

First, identify every ICS instance in your environment. Check the version running on each. Ivanti's patches cover two of the three flaws. Apply those patches immediately to affected versions.

Second, understand that one vulnerability remains unpatched. Until Ivanti releases the third fix, your appliance remains partially vulnerable even after patching. Monitor Ivanti's security advisories daily for the third patch and deploy it the moment it becomes available.

Third, audit your VPN logs for signs of compromise. Look for unusual administrative activity, configuration changes, or authentication anomalies. If you find evidence of exploitation, assume the appliance is fully compromised and treat it as hostile. That means rotating credentials for any accounts that authenticated through the VPN and conducting a full incident response.

Fourth, if you cannot patch immediately, consider taking the appliance offline or restricting access to known IP ranges as a temporary mitigation. This reduces your attack surface but also disrupts remote access. Weigh the operational impact against the risk of full compromise.

Gotchas and Limits

Patching two out of three vulnerabilities is better than patching none, but it does not eliminate the risk. The third unpatched flaw could still be exploitable on its own or in combination with other techniques not yet disclosed.

Ivanti has a history of VPN appliance vulnerabilities. Earlier supply chain and zero-day incidents have made Ivanti devices a high-value target for sophisticated attackers. Assume that threat actors are actively scanning for vulnerable instances and attempting exploitation.

Volexity has not published indicators of compromise or detailed exploit signatures. This limits your ability to detect past exploitation through automated scanning. Manual log review and behavioral analysis are your best tools until more forensic guidance becomes available.

Even after patching, backdoors installed during the window of vulnerability may persist. Patching closes the door but does not evict an attacker who is already inside. Full remediation may require rebuilding the appliance from a known-good configuration and re-validating all connected systems.

How We Would Use It

If we managed an Ivanti Connect Secure deployment, we would immediately inventory every appliance, apply the available patches, and schedule downtime to apply the third patch the moment it ships.

We would also start building a migration plan. Repeated critical vulnerabilities in a single product line signal systemic risk. While no VPN platform is immune to flaws, a pattern of severe zero-days suggests it may be time to evaluate alternatives.

In the short term, we would add additional monitoring and logging around the VPN perimeter. We would collect and forward all authentication and administrative logs to a separate SIEM or log aggregation system that the appliance itself cannot modify.

We would also review our network segmentation. A compromised VPN gateway should not grant an attacker unrestricted access to internal resources. Least-privilege network policies, micro-segmentation, and zero-trust controls can limit the blast radius even if the perimeter is breached.

Finally, we would brief stakeholders on the risk and the remediation timeline. Business leaders need to understand that partial patching is not full protection and that this incident may justify accelerated investment in perimeter security alternatives.

This is not a theoretical risk. Volexity observed active exploitation in the wild. If attackers are already using this chain, your exposure window started before the disclosure. Treat this as an active incident until you have patched, audited, and verified the integrity of your VPN infrastructure.