Attackers chained three Ivanti Connect Secure zero-days, part of which Ivanti had found in June

Volexity researchers found attackers exploiting Ivanti Connect Secure, the company's VPN product, earlier this month. CyberScoop reports that the attackers chained three zero-day flaws to get past authentication, run code remotely and escalate privileges. Volexity tracks the group as UTA0576. Ivanti has disclosed and patched the authentication bypass and remote code execution parts of the chain as a single high-severity flaw, CVE-2026-104935. The company says it found part of the defect during internal security checks in June, but decided it did not justify an emergency out-of-band release. The attackers exploited the flaws before Ivanti patched them. Security Affairs reports that the US Cybersecurity and Infrastructure Security Agency (CISA) has added the Ivanti Connect Secure flaw to its Known Exploited Vulnerabilities catalog. That listing tells federal agencies to fix it and signals urgency to everyone else. SecurityWeek places the fix in a wider round of patches covering 29 vulnerabilities across Citrix, Fortinet and Ivanti products. Ivanti's share covers seven flaws in Connect Secure, Neurons Patch for Intune and Xtraction. Fortinet's includes critical flaws in FortiSIEM and the FortiSandbox GUI, tracked as CVE-2026-106173 and CVE-2026-107656. Connect Secure is a frequent target, so organizations that run it are advised to patch now.