{
  "id": 14281160,
  "title": "Three Ivanti Connect Secure Zero-Days Chained for Unauthenticated Root, One Still Unpatched",
  "url": "https://urgent.news/2026/10/13/three-ivanti-connect-secure-zero-days-chained-for-unauthenticated",
  "topic": "tech",
  "section": "Tech",
  "published": "2026-10-13T20:04:36.000Z",
  "source": {
    "name": "Dev.to",
    "slug": "dev-to",
    "url": "https://dev.to/etairos/three-ivanti-connect-secure-zero-days-chained-for-unauthenticated-root-one-still-unpatched-44eg"
  },
  "original_language": "en",
  "account": "An attacker, identified as UTA0576, exploited three previously unknown vulnerabilities in Ivanti Connect Secure to gain root-level access to a VPN appliance without needing to authenticate. The security firm Volexity discovered this chain of attacks and reported them to Ivanti on October 13, 2026. The first two vulnerabilities allowed the attacker to bypass authentication and execute arbitrary code, while the third flaw enabled the attacker to escalate their privileges to root. Ivanti has released patches for two of the flaws, but the third, a privilege escalation vulnerability, is still unpatched. Organizations using Ivanti Connect Secure versions prior to 25.1.3.0, except for 22.7R2.14 and 22.8R2.5, are affected by this chain of exploits. The vulnerability rating for the three combined flaws is 8.6 out of 10 on the CVSS scale, with exploitation classified as active and the technical impact described as total. Ivanti has advised customers to upgrade their software and regularly run the Integrity Checker Tool. However, Volexity has stated that this tool is unable to detect the specific chain of vulnerabilities. In the single incident Volexity investigated, the attacker stole stored credentials, including LDAP domain credentials, searched Active Directory for passwords, and carried out password-spraying attacks. The attacker's motive was suspected to be criminal rather than espionage, based on limited evidence from a single case. Ivanti recommends upgrading to a patched version and running the Integrity Checker Tool regularly, but no interim mitigation has been provided for the pending privilege escalation fix.",
  "summary": "TL;DR what: An attacker tracked as UTA0576 chained three zero-day flaws in Ivanti Connect Secure to run commands as root on a fully patched appliance without authenticating. impact: In the one incident Volexity investigated, the attacker stole stored credentials including LDAP domain credentials, searched Active Directory for passwords and ran password-spraying attacks. fix: Ivanti fixed the…",
  "key_points": [],
  "editors_take": null,
  "illustration": null,
  "coverage": {
    "outlets": 3,
    "also_reported_by": [
      {
        "outlet": "The Hacker News",
        "title": "Attacker Chains Three Ivanti Connect Secure Zero-Days for Root Access, Only Two Patched So Far",
        "url": "https://urgent.news/2026/10/13/attacker-chains-three-ivanti-connect-secure-zero-days-for-root-access",
        "published": "2026-10-13T17:33:11.000Z"
      },
      {
        "outlet": "SecurityWeek",
        "title": "Ivanti Zero-Day Chain Gave Attackers Root Access to Fully Patched VPN",
        "url": "https://urgent.news/2026/10/13/ivanti-zero-day-chain-gave-attackers-root-access-to-fully-patched-vpn",
        "published": "2026-10-13T18:43:43.000Z"
      }
    ]
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}