Ivanti Zero-Day Chain Gave Attackers Root Access to Fully Patched VPN

Ivanti on Tuesday warned customers that a zero-day vulnerability in its Connect Secure (ICS) VPN appliances has been exploited in the wild. Tracked as CVE-2026-104935 and rated high severity, the issue is an authentication bypass that lets a remote, unauthenticated attacker execute arbitrary commands. Ivanti says it’s aware of exploitation affecting a limited number of customers. Volexity discovered the in-the-wild exploitation while investigating an incident at one of its customers. A previously undocumented threat actor it tracks as UTA0576 had chained three zero-days to gain…