Attacker Chains Three Ivanti Connect Secure Zero-Days for Root Access, Only Two Patched So Far

An attacker chained three zero-day vulnerabilities in Ivanti Connect Secure, a widely used VPN appliance, to achieve unauthenticated root-level command execution. The attack chain was discovered and reported to Ivanti by security firm Volexity on October 13, 2026. Ivanti has released patches for two of the three flaws but the third remains unpatched. Ivanti urged customers on affected versions to act immediately. The ability to gain root access without authentication makes this a critical threat. The chaining of multiple zero-days indicates a sophisticated attacker. No specific CVE identifiers were mentioned in the article excerpt. Volexity's disclosure highlights active exploitation risk for organizations using Ivanti Connect Secure.