Attacker Chains Three Ivanti Connect Secure Zero-Days for Root Access, Only Two Patched So Far

Attacker UTA0576 chained three zero-day flaws in Ivanti Connect Secure to execute root commands without authentication. Volexity reports the attacker stole LDAP domain credentials and conducted password-spraying attacks via Active Directory. Ivanti has released fixes for the authentication bypass and remote code execution flaws, specifically CVE-2026-104935, but the privilege escalation fix is still pending. Organizations running affected versions are urged to act immediately, while versions 22.8R2.5, 25.1.3.0, and 25.1.3.1 remain unaffected.