Ivanti Connect Secure exploit chain leads to root access

Volexity detailed a three-link exploit chain in Ivanti Connect Secure: an authentication bypass and file write (CVE-2026-104935, CVSS 8.6) plus an unpatched privilege escalation. Exploitation began on 3 October 2026 against a fully patched 22.8R2.4 build, with fixes released on 13 October.

• CVE-2026-104935 at 8.6 combines an auth bypass and a file write
• Exploitation began 3 October, patches arrived 13 October — ten days later
• The final privilege-escalation link to root has no patch yet
• The chain steals LDAP credentials, LAPS passwords and BitLocker keys, evading the Integrity Checker