Ivanti Connect Secure VPN Zero-Day Exploited for Root Access

Key points

• CVE-2026-104935 affects Ivanti Connect Secure VPN.
• Exploitation allows unauthenticated RCE and root-level access.
• Fully patched systems have been compromised.
• Attackers use a zero-day exploit chain.
• High severity; immediate mitigation and detection are critical.

In 2026, a critical zero-day vulnerability chain, identified as CVE-2026-104935, was exploited in Ivanti's Connect Secure VPN solution. Attackers leveraged this chain to achieve unauthenticated remote code execution, ultimately gaining root-level access and elevated permissions on targeted systems. Notably, even instances that were fully patched were successfully compromised, indicating the exploit bypassed existing defenses.

This vulnerability affects any organization relying on Ivanti Connect Secure VPN, with government entities and K-12 school districts being particularly at risk due to the sensitive data they handle. The unauthenticated nature of the exploit means that an attacker with network access can trigger it without needing valid credentials, significantly lowering the barrier to entry.

The impact is severe: root access grants attackers complete control over the VPN appliance, enabling them to steal credentials, move laterally into internal networks, and establish persistent backdoors. For K-12 environments, this could lead to unauthorized access to student records, disruption of remote learning, and potential ransomware deployment.

The fact that fully patched systems were compromised underscores the sophistication of this zero-day chain and the need for defense-in-depth strategies. While Ivanti is expected to release patches, organizations must assume that patching alone may not be sufficient and should implement additional monitoring and containment measures.

What to watch: Keep a close eye on Ivanti's security advisories for updates and indicators of compromise. Monitor VPN logs for unusual authentication attempts, unexpected processes, or outbound connections. Given the high severity, immediate action is warranted to protect your network.

What to do now

1. Apply any available Ivanti patches or mitigations immediately, even if you believe your systems are fully updated.
2. Assume compromise: inspect Connect Secure appliances for indicators of compromise, including unusual files, processes, or network connections.
3. Isolate or temporarily disable vulnerable VPN appliances if compromise is suspected or until a patch is verified.
4. Reset all credentials and revoke active sessions for users who have connected through the VPN.
5. Enforce multi-factor authentication (MFA) and principle of least privilege across all remote access services.
6. Monitor network traffic for lateral movement, data exfiltration, or command-and-control activity.
7. Report any suspicious activity to your security operations center and relevant authorities (e.g., CISA, MS-ISAC).

CVE references

• CVE-2026-104935

Original source

SecurityWeek