{"id":12328,"date":"2026-10-30T18:09:34","date_gmt":"2026-10-31T00:09:34","guid":{"rendered":"https:\/\/beaconlab.us\/publicacion\/alert-2026-133-an-actively-exploited-chain-of-zero-day-vulnerabilities-in-ivanti-connect-secure-enables-remote-execution-as-root-without-authentication\/"},"modified":"2026-10-30T18:10:36","modified_gmt":"2026-10-31T00:10:36","slug":"alert-2026-133-an-actively-exploited-chain-of-zero-day-vulnerabilities-in-ivanti-connect-secure-enables-remote-execution-as-root-without-authentication","status":"publish","type":"publicacion","link":"https:\/\/beaconlab.us\/en\/publication\/alert-2026-133-an-actively-exploited-chain-of-zero-day-vulnerabilities-in-ivanti-connect-secure-enables-remote-execution-as-root-without-authentication\/","title":{"rendered":"Alert 2026-133 An actively exploited chain of zero-day vulnerabilities in Ivanti Connect Secure enables remote execution as root without authentication"},"content":{"rendered":"\n<h2 class=\"wp-block-heading\">Affected product(s):\u00a0<\/h2>\n\n<figure class=\"wp-block-table\"><table class=\"has-fixed-layout\"><tbody><tr><td><strong>Product<\/strong><\/td><td><strong>Affected versions<\/strong><\/td><td><strong>Fixed version<\/strong><\/td><\/tr><tr><td><strong>Ivanti Connect Secure, 25.1.1.x branch and earlier<\/strong><\/td><td>25.1.1.2 and earlier (CVE-2026-104935: 25.1.1.1 and earlier)<\/td><td>25.1.1.3<\/td><\/tr><tr><td><strong>Ivanti Connect Secure, 25.1.2.x and 25.1.3.x branches<\/strong><\/td><td>25.1.2.2 and earlier (CVE-2026-104935)<\/td><td>25.1.3.1<\/td><\/tr><tr><td><strong>Ivanti Connect Secure, 22.8 branch<\/strong><\/td><td>22.8R2.5 and earlier (CVE-2026-104935: 22.8R2.4 and earlier)<\/td><td>22.8R2.6<\/td><\/tr><\/tbody><\/table><\/figure>\n\n<p class=\"wp-block-paragraph\">Versions 22.7R2.14 and earlier are not affected by CVE-2026-104935, and neither Ivanti Policy Secure nor Neurons for ZTA gateways have been reported as affected.<\/p>\n\n<h2 class=\"wp-block-heading\">Description<\/h2>\n\n<p class=\"wp-block-paragraph\">An actively exploited chain of vulnerabilities has been reported in Ivanti Connect Secure, Ivanti&#8217;s SSL VPN solution, allowing a remote attacker without credentials to execute commands as root on the device. The chain combines three vulnerabilities, designated as CVE-2026-104935, CVE-2026-111357 and CVE-2026-118527, which are listed in the Known Exploited Vulnerabilities (KEV) catalog of the U.S. cybersecurity agency. Individually, none exceeds High severity; chained together, they provide full control of the device, so this advisory is rated CRITICAL.<\/p>\n\n<figure class=\"wp-block-table\"><table class=\"has-fixed-layout\"><tbody><tr><td><strong>CVE<\/strong><\/td><td><strong>Type<\/strong><\/td><td><strong>CVSS v3.1<\/strong><\/td><td><strong>Fix<\/strong><\/td><td><strong>KEV inclusion<\/strong><\/td><\/tr><tr><td><strong>CVE-2026-104935<\/strong><\/td><td>Authentication bypass via spoofing that allows commands to be executed without authentication<\/td><td>8.6<\/td><td>13\/10\/2026<\/td><td>13\/10\/2026<\/td><\/tr><tr><td><strong>CVE-2026-111357<\/strong><\/td><td>Privilege escalation to root (<code>dsinvoked<\/code> service and <code>DSCache<\/code> configuration data)<\/td><td>8.8 according to the vendor (7.0 according to NVD)<\/td><td>29\/10\/2026<\/td><td>30\/10\/2026<\/td><\/tr><tr><td><strong>CVE-2026-118527<\/strong><\/td><td>Generation of predictable identifiers that allows files with attacker-controlled content to be uploaded to a known path on disk<\/td><td>4.3<\/td><td>29\/10\/2026<\/td><td>30\/10\/2026<\/td><\/tr><\/tbody><\/table><\/figure>\n\n<p class=\"wp-block-paragraph\">Researchers indicate that an unidentified threat actor has been exploiting the chain since 03\/10\/2026 and attribute the activity, with low confidence, to criminal motives. The first compromised device analyzed had the latest available version installed at that time (22.8R2.4). The vendor stated that it is aware of exploitation against a limited number of customers, and a government source considers continued exploitation highly likely.<\/p>\n\n<p class=\"wp-block-paragraph\">The chain works in three steps:<\/p>\n\n<ul class=\"wp-block-list\">\n<li>The attacker sends requests to the public login page (<code>\/dana-na\/auth\/url_default\/welcome.cgi<\/code>) with an <code>X-DSCGI-PATH<\/code> header pointing to another internal script. The device decides whether to allow the request based on the URL, but routes it according to the header, which provides access to protected scripts without authentication.<\/li>\n\n\n\n<li>Through the <code>wu.cgi<\/code> upload handler, the attacker uploads a file that is written to a predictable path before validation and executes it by exploiting a race condition. This provides code execution as the web server user.<\/li>\n\n\n\n<li>Finally, the attacker modifies in memory the configuration data trusted by the privileged <code>dsinvoked<\/code> service so that a maintenance task executes the attacker&#8217;s script as root, after which everything is restored to its original state.<\/li>\n<\/ul>\n\n<p class=\"wp-block-paragraph\">The vendor fixed CVE-2026-104935 on 13\/10, but that fix did not cover the privilege escalation, which was resolved on 29\/10 together with CVE-2026-118527. A device patched only with the 13\/10 fix on the 25.1.1.x (25.1.1.2) or 22.8 (22.8R2.5) branches remains exposed to escalation to root. The U.S. cybersecurity agency set a deadline of 16\/10\/2026 for CVE-2026-104935 and 02\/11\/2026 for CVE-2026-111357, both subject to mandatory forensic triage, and 13\/11\/2026 for CVE-2026-118527.<\/p>\n\n<p class=\"wp-block-paragraph\">The attacker does not install webshells or backdoors: the entire chain is repeated for each command, and the results are received in the HTTPS response itself. According to researchers, once inside, the attacker:<\/p>\n\n<ul class=\"wp-block-list\">\n<li>Extracted credentials stored on the device, such as the domain credentials it uses for LDAP.<\/li>\n\n\n\n<li>Used the Active Directory service account configured in the VPN to search for local administrator passwords (LAPS), BitLocker recovery keys and password attributes (<code>userPassword<\/code>, <code>unixUserPassword<\/code>).<\/li>\n\n\n\n<li>Used a custom tool for Kerberoasting and credential testing, and conducted password spraying against Active Directory accounts.<\/li>\n\n\n\n<li>Captured traffic from the device to obtain plaintext credentials and NTLM hashes, and reviewed authentication logs to identify valid users.<\/li>\n\n\n\n<li>Collected device configuration and Active Directory metadata, and performed DNS and local reconnaissance.<\/li>\n\n\n\n<li>Selectively deleted entries from the debug and audit logs, and deleted their own files.<\/li>\n<\/ul>\n\n<p class=\"wp-block-paragraph\">Because the changes occur only in memory and the configuration is restored, the vendor&#8217;s integrity verification tool (Integrity Checker Tool, ICT) may fail to detect the compromise. No public exploit or use of this chain in ransomware campaigns has been reported.<\/p>\n\n<h2 class=\"wp-block-heading\">Mitigation<\/h2>\n\n<p class=\"wp-block-paragraph\">As general recommendations, while the update is being applied and on devices that were exposed:<\/p>\n\n<ul class=\"wp-block-list\">\n<li>Block <code>108.165.147[.]64<\/code> and search for historical connections to that IP address.<\/li>\n\n\n\n<li>Monitor the volume of requests to <code>welcome.cgi<\/code> with the <code>X-DSCGI-PATH<\/code> header and inspect the device&#8217;s <code>\/tmp\/<\/code> directory.<\/li>\n\n\n\n<li>Do not consider a clean ICT result sufficient: confirming or ruling out the compromise requires forensic analysis of memory and network traffic.<\/li>\n\n\n\n<li>Minimize the privileges of the Active Directory service account used by the VPN and review its LDAP queries involving the <code>ms-Mcs-AdmPwd<\/code>, <code>msLAPS-Password<\/code> and <code>msFVE-RecoveryInformation<\/code> attributes.<\/li>\n\n\n\n<li>In Active Directory, review bulk requests for service tickets using RC4 (Kerberoasting), large numbers of failed authentication attempts originating from the VPN device&#8217;s internal IP address, and attempts at lateral movement from that device.<\/li>\n\n\n\n<li>Preserve the evidence (memory and disk images, memory dumps and logs) before rebooting or updating a suspicious device.<\/li>\n<\/ul>\n\n<h2 class=\"wp-block-heading\">Indicators of compromise<\/h2>\n\n<p class=\"wp-block-paragraph\">The vendor stated that the available indicators of compromise are limited. Researchers published the following:<\/p>\n\n<p class=\"wp-block-paragraph\"><strong>Network<\/strong><\/p>\n\n<ul class=\"wp-block-list\">\n<li>IP address used for exploitation: <code>108.165.147[.]64<\/code>.<\/li>\n\n\n\n<li>A high volume of requests to <code>\/dana-na\/auth\/url_default\/welcome.cgi<\/code> with headers such as <code>X-DSCGI-PATH: \/home\/webserver\/htdocs\/dana\/fb\/smb\/wu.cgi<\/code> or <code>X-DSCGI-PATH: \/home\/runtime\/tmp\/&lt;MD5(filename)&gt;<\/code>.<\/li>\n\n\n\n<li>Any discrepancy between the URL path and the value of <code>X-DSCGI-PATH<\/code>, as other paths could be used.<\/li>\n\n\n\n<li>Connections originating from the VPN device to domain controllers or other internal systems, and password spraying from its internal IP address.<\/li>\n<\/ul>\n\n<p class=\"wp-block-paragraph\"><strong>Files and paths on the device<\/strong><\/p>\n\n<ul class=\"wp-block-list\">\n<li><code>\/tmp\/ml.py<\/code>, <code>\/tmp\/rq5.py<\/code>, <code>\/tmp\/mk.py<\/code>, <code>\/tmp\/rr.py<\/code>, <code>\/tmp\/pu.txt<\/code>, <code>\/tmp\/sp_out.txt<\/code>, <code>\/tmp\/spray_hits.json<\/code>, <code>sp_run.py<\/code> and JSON files compressed with zlib and encoded in Base64 in <code>\/tmp\/<\/code>.<\/li>\n\n\n\n<li>Hidden directory <code>\/data\/.icscap\/<\/code> (<code>\/home\/root\/data\/.icscap\/<\/code>) containing the <code>dsstatmond<\/code> executable (a renamed <code>tcpdump<\/code>), rotating captures <code>cap0<\/code> through <code>cap7<\/code> and the <code>h.py<\/code> script, executed using <code>\/home\/venv3\/bin\/python3.6<\/code>.<\/li>\n\n\n\n<li><code>\/home\/runtime\/tmp\/ics-root-run-inband-*.pl<\/code> and <code>\/home\/runtime\/tmp\/ics-root-result-inband-*<\/code>.<\/li>\n\n\n\n<li>Memory dumps (core dumps) generated during exploitation.<\/li>\n<\/ul>\n\n<p class=\"wp-block-paragraph\"><strong>Processes and configuration<\/strong><\/p>\n\n<ul class=\"wp-block-list\">\n<li><code>dsstatmond<\/code> process capturing LDAP, HTTP, FTP and telnet traffic from a hidden directory.<\/li>\n\n\n\n<li><code>DSCache<\/code> entry <code>ScriptUtil\/updateOpswatSDK<\/code> pointing to a program other than <code>\/home\/bin\/updateOpswatSDK.pl<\/code>.<\/li>\n\n\n\n<li>Gaps or recent truncations in <code>\/home\/runtime\/dlogs\/debuglog<\/code> and <code>\/var\/log\/audit\/audit.log<\/code>.<\/li>\n<\/ul>\n\n<p class=\"wp-block-paragraph\"><strong>Hash (SHA-256)<\/strong><\/p>\n\n<ul class=\"wp-block-list\">\n<li>Python implementation of the privilege escalation exploit: <code>25b95f47359c327e3a5ae5ac5cd147f8d9afd98092faf136822ee287e25e3dc8<\/code><\/li>\n<\/ul>\n\n<p class=\"wp-block-paragraph\">Researchers also published YARA rules to detect the request headers in files or memory (<code>exploit_log_ivanti_rce<\/code>) and the Python exploit (<code>exploit_py_ivanti_oct26<\/code>).<\/p>\n\n<h2 class=\"wp-block-heading\">Solution<\/h2>\n\n<p class=\"wp-block-paragraph\">The solution is to update each device to the fixed version for its branch:<\/p>\n\n<ul class=\"wp-block-list\">\n<li>25.1.1.x branch: 25.1.1.3.<\/li>\n\n\n\n<li>25.1.2.x and 25.1.3.x branches: 25.1.3.1 (25.1.3.0 fixes CVE-2026-104935, but 25.1.3.1 is recommended).<\/li>\n\n\n\n<li>22.8 branch: 22.8R2.6.<\/li>\n<\/ul>\n\n<p class=\"wp-block-paragraph\">Devices that only received the 13\/10 fix must be updated again. The 22.8 branch reaches end of life on 31\/01\/2027, and the vendor recommends migrating to the 25.x branch.<\/p>\n\n<p class=\"wp-block-paragraph\">If a compromise is suspected, follow the recovery procedure outlined by the U.S. cybersecurity agency:<\/p>\n\n<ol class=\"wp-block-list\">\n<li>Back up the device configuration.<\/li>\n\n\n\n<li>Reset the device to factory settings and update it to the fixed version. On virtual devices or in the cloud, rebuild the instance.<\/li>\n\n\n\n<li>Restore the configuration from the backup.<\/li>\n\n\n\n<li>Reset the passwords for all accounts (domain, administrator and local), revoke and reissue the stored certificates, and reset the API keys and license server credentials.<\/li>\n<\/ol>\n\n<p class=\"wp-block-paragraph\">Additionally, if the compromise is confirmed, rotate the Active Directory and LDAP service account configured in the VPN, the LAPS passwords and BitLocker recovery keys that may have been queried, and review the rest of the network for lateral movement.<\/p>\n\n<p class=\"wp-block-paragraph\">For information on how to update, visit the following link:<\/p>\n\n<p class=\"wp-block-paragraph\"><a href=\"https:\/\/hub.ivanti.com\/s\/article\/Security-Advisory-Ivanti-Connect-Secure-CVE-2026-104935\">https:\/\/hub.ivanti.com\/s\/article\/Security-Advisory-Ivanti-Connect-Secure-CVE-2026-104935<\/a><\/p>\n\n<h2 class=\"wp-block-heading\">Additional information:\u00a0<\/h2>\n\n<ul class=\"wp-block-list\">\n<li>Ivanti \u2014 Ivanti Connect Secure security advisory (CVE-2026-104935, CVE-2026-111357 and CVE-2026-118527):<br \/><a href=\"https:\/\/hub.ivanti.com\/s\/article\/Security-Advisory-Ivanti-Connect-Secure-CVE-2026-104935\" target=\"_blank\" rel=\"noopener\">https:\/\/hub.ivanti.com\/s\/article\/Security-Advisory-Ivanti-Connect-Secure-CVE-2026-104935<\/a><\/li>\n\n\n\n<li>Ivanti \u2014 October 2026 security update:<br \/><a href=\"https:\/\/www.ivanti.com\/blog\/october-2026-security-update\" target=\"_blank\" rel=\"noopener\">https:\/\/www.ivanti.com\/blog\/october-2026-security-update<\/a><\/li>\n\n\n\n<li>Volexity \u2014 technical analysis of the chain and post-exploitation activity:<br \/><a href=\"https:\/\/www.volexity.com\/blog\/2026\/10\/13\/a-series-of-unauthenticated-events-chained-exploitation-of-ivanti-connect-secure-zero-days\/\" target=\"_blank\" rel=\"noopener\">https:\/\/www.volexity.com\/blog\/2026\/10\/13\/a-series-of-unauthenticated-events-chained-exploitation-of-ivanti-connect-secure-zero-days\/<\/a><\/li>\n\n\n\n<li>Volexity \u2014 indicators of compromise and YARA rules:<br \/><a href=\"https:\/\/github.com\/volexity\/threat-intel\/tree\/main\/2026\/2026-10-13%20Ivanti\" target=\"_blank\" rel=\"noopener\">https:\/\/github.com\/volexity\/threat-intel\/tree\/main\/2026\/2026-10-13%20Ivanti<\/a><\/li>\n\n\n\n<li>CISA \u2014 alert on CVE-2026-104935 and recovery steps:<br \/><a href=\"https:\/\/www.cisa.gov\/news-events\/alerts\/2026\/10\/13\/cisa-urges-patching-newly-exploited-vulnerability-ivanti-connect-secure\" target=\"_blank\" rel=\"noopener\">https:\/\/www.cisa.gov\/news-events\/alerts\/2026\/10\/13\/cisa-urges-patching-newly-exploited-vulnerability-ivanti-connect-secure<\/a><\/li>\n\n\n\n<li>CISA \u2014 addition of CVE-2026-111357 and CVE-2026-118527 to the KEV catalog:<br \/><a href=\"https:\/\/www.cisa.gov\/news-events\/alerts\/2026\/10\/30\/cisa-adds-two-known-exploited-vulnerabilities-catalog\" target=\"_blank\" rel=\"noopener\">https:\/\/www.cisa.gov\/news-events\/alerts\/2026\/10\/30\/cisa-adds-two-known-exploited-vulnerabilities-catalog<\/a><\/li>\n\n\n\n<li>Canadian Centre for Cybersecurity \u2014 AV26-1035 advisory:<br \/><a href=\"https:\/\/www.cyber.gc.ca\/en\/alerts-advisories\/ivanti-security-advisory-av26-1035\" target=\"_blank\" rel=\"noopener\">https:\/\/www.cyber.gc.ca\/en\/alerts-advisories\/ivanti-security-advisory-av26-1035<\/a><\/li>\n\n\n\n<li>NHS England \u2014 CC-4866 alert:<br \/><a href=\"https:\/\/digital.nhs.uk\/cyber-alerts\/2026\/cc-4866\" target=\"_blank\" rel=\"noopener\">https:\/\/digital.nhs.uk\/cyber-alerts\/2026\/cc-4866<\/a><\/li>\n\n\n\n<li>NVD \u2014 CVE-2026-111357:<br \/><a href=\"https:\/\/nvd.nist.gov\/vuln\/detail\/CVE-2026-111357\" target=\"_blank\" rel=\"noopener\">https:\/\/nvd.nist.gov\/vuln\/detail\/CVE-2026-111357<\/a><\/li>\n<\/ul>\n","protected":false},"featured_media":12324,"template":"","class_list":["post-12328","publicacion","type-publicacion","status-publish","has-post-thumbnail","hentry"],"acf":[],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 5.0.3 - aioseo.com -->\n\t<meta name=\"description\" content=\"Three-flaw chain actively exploited in Ivanti Connect Secure grants root without authentication. Update to 25.1.1.3, 25.1.3.1 or 22.8R2.6.\" \/>\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<link rel=\"canonical\" href=\"https:\/\/beaconlab.us\/en\/publication\/alert-2026-133-an-actively-exploited-chain-of-zero-day-vulnerabilities-in-ivanti-connect-secure-enables-remote-execution-as-root-without-authentication\/\" \/>\n\t\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 5.0.3\" \/>\n\t\t<meta property=\"og:locale\" content=\"en_US\" \/>\n\t\t<meta property=\"og:site_name\" content=\"Beacon Lab - CSIRT by Cybolt\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"Ivanti Connect Secure: zero-day chain allows remote root\" \/>\n\t\t<meta property=\"og:description\" content=\"Three-flaw chain actively exploited in Ivanti Connect Secure grants root without authentication. Update to 25.1.1.3, 25.1.3.1 or 22.8R2.6.\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/beaconlab.us\/en\/publication\/alert-2026-133-an-actively-exploited-chain-of-zero-day-vulnerabilities-in-ivanti-connect-secure-enables-remote-execution-as-root-without-authentication\/\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/beaconlab.us\/wp-content\/uploads\/2026\/10\/og-ivanti-2026-133-1200x630-1.png\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/beaconlab.us\/wp-content\/uploads\/2026\/10\/og-ivanti-2026-133-1200x630-1.png\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2026-10-31T00:09:34+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2026-10-31T00:10:36+00:00\" \/>\n\t\t<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n\t\t<meta name=\"twitter:site\" content=\"@BeaconLabMX\" \/>\n\t\t<meta name=\"twitter:title\" content=\"Ivanti Connect Secure: zero-day chain allows remote root\" \/>\n\t\t<meta name=\"twitter:description\" content=\"Three-flaw chain actively exploited in Ivanti Connect Secure grants root without authentication. Update to 25.1.1.3, 25.1.3.1 or 22.8R2.6.\" \/>\n\t\t<meta name=\"twitter:image\" content=\"https:\/\/beaconlab.us\/wp-content\/uploads\/2026\/10\/og-ivanti-2026-133-1200x630-1.png\" \/>\n\t\t<script type=\"application\/ld+json\" class=\"aioseo-schema\">\n\t\t\t{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/beaconlab.us\\\/en\\\/publication\\\/alert-2026-133-an-actively-exploited-chain-of-zero-day-vulnerabilities-in-ivanti-connect-secure-enables-remote-execution-as-root-without-authentication\\\/#breadcrumblist\",\"itemListElement\":[{\"@type\":\"ListItem\",\"@id\":\"https:\\\/\\\/beaconlab.us\\\/en\\\/#listItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\\\/\\\/beaconlab.us\\\/en\\\/\",\"nextItem\":{\"@type\":\"ListItem\",\"@id\":\"https:\\\/\\\/beaconlab.us\\\/en\\\/publication\\\/alert-2026-133-an-actively-exploited-chain-of-zero-day-vulnerabilities-in-ivanti-connect-secure-enables-remote-execution-as-root-without-authentication\\\/#listItem\",\"name\":\"Alert 2026-133 An actively exploited chain of zero-day vulnerabilities in Ivanti Connect Secure enables remote execution as root without authentication\"}},{\"@type\":\"ListItem\",\"@id\":\"https:\\\/\\\/beaconlab.us\\\/en\\\/publication\\\/alert-2026-133-an-actively-exploited-chain-of-zero-day-vulnerabilities-in-ivanti-connect-secure-enables-remote-execution-as-root-without-authentication\\\/#listItem\",\"position\":2,\"name\":\"Alert 2026-133 An actively exploited chain of zero-day vulnerabilities in Ivanti Connect Secure enables remote execution as root without authentication\",\"previousItem\":{\"@type\":\"ListItem\",\"@id\":\"https:\\\/\\\/beaconlab.us\\\/en\\\/#listItem\",\"name\":\"Home\"}}]},{\"@type\":\"Organization\",\"@id\":\"https:\\\/\\\/beaconlab.us\\\/en\\\/#organization\",\"name\":\"Beacon Lab\",\"description\":\"CSIRT by Cybolt\",\"url\":\"https:\\\/\\\/beaconlab.us\\\/en\\\/\",\"telephone\":\"+528007374357\",\"logo\":{\"@type\":\"ImageObject\",\"url\":\"https:\\\/\\\/beaconlab.mx\\\/wp-content\\\/uploads\\\/2023\\\/12\\\/BeaconLab_V2-03.png\",\"@id\":\"https:\\\/\\\/beaconlab.us\\\/en\\\/publication\\\/alert-2026-133-an-actively-exploited-chain-of-zero-day-vulnerabilities-in-ivanti-connect-secure-enables-remote-execution-as-root-without-authentication\\\/#organizationLogo\"},\"image\":{\"@id\":\"https:\\\/\\\/beaconlab.us\\\/en\\\/publication\\\/alert-2026-133-an-actively-exploited-chain-of-zero-day-vulnerabilities-in-ivanti-connect-secure-enables-remote-execution-as-root-without-authentication\\\/#organizationLogo\"},\"sameAs\":[\"https:\\\/\\\/twitter.com\\\/BeaconLabMX\",\"https:\\\/\\\/www.linkedin.com\\\/showcase\\\/beaconlabmx\"]},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/beaconlab.us\\\/en\\\/publication\\\/alert-2026-133-an-actively-exploited-chain-of-zero-day-vulnerabilities-in-ivanti-connect-secure-enables-remote-execution-as-root-without-authentication\\\/#webpage\",\"url\":\"https:\\\/\\\/beaconlab.us\\\/en\\\/publication\\\/alert-2026-133-an-actively-exploited-chain-of-zero-day-vulnerabilities-in-ivanti-connect-secure-enables-remote-execution-as-root-without-authentication\\\/\",\"name\":\"Ivanti Connect Secure: zero-day chain allows remote root\",\"description\":\"Three-flaw chain actively exploited in Ivanti Connect Secure grants root without authentication. Update to 25.1.1.3, 25.1.3.1 or 22.8R2.6.\",\"inLanguage\":\"en-US\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/beaconlab.us\\\/en\\\/#website\"},\"breadcrumb\":{\"@id\":\"https:\\\/\\\/beaconlab.us\\\/en\\\/publication\\\/alert-2026-133-an-actively-exploited-chain-of-zero-day-vulnerabilities-in-ivanti-connect-secure-enables-remote-execution-as-root-without-authentication\\\/#breadcrumblist\"},\"image\":{\"@type\":\"ImageObject\",\"url\":\"https:\\\/\\\/beaconlab.us\\\/wp-content\\\/uploads\\\/2026\\\/10\\\/ivanti-logo-destacada.png\",\"@id\":\"https:\\\/\\\/beaconlab.us\\\/en\\\/publication\\\/alert-2026-133-an-actively-exploited-chain-of-zero-day-vulnerabilities-in-ivanti-connect-secure-enables-remote-execution-as-root-without-authentication\\\/#mainImage\",\"width\":600,\"height\":600},\"primaryImageOfPage\":{\"@id\":\"https:\\\/\\\/beaconlab.us\\\/en\\\/publication\\\/alert-2026-133-an-actively-exploited-chain-of-zero-day-vulnerabilities-in-ivanti-connect-secure-enables-remote-execution-as-root-without-authentication\\\/#mainImage\"},\"datePublished\":\"2026-10-30T18:09:34-06:00\",\"dateModified\":\"2026-10-30T18:10:36-06:00\"},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/beaconlab.us\\\/en\\\/#website\",\"url\":\"https:\\\/\\\/beaconlab.us\\\/en\\\/\",\"name\":\"Beacon Lab\",\"description\":\"CSIRT by Cybolt\",\"inLanguage\":\"en-US\",\"publisher\":{\"@id\":\"https:\\\/\\\/beaconlab.us\\\/en\\\/#organization\"}}]}\n\t\t<\/script>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"Ivanti Connect Secure: zero-day chain allows remote root","description":"Three-flaw chain actively exploited in Ivanti Connect Secure grants root without authentication. Update to 25.1.1.3, 25.1.3.1 or 22.8R2.6.","canonical_url":"https:\/\/beaconlab.us\/en\/publication\/alert-2026-133-an-actively-exploited-chain-of-zero-day-vulnerabilities-in-ivanti-connect-secure-enables-remote-execution-as-root-without-authentication\/","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"BreadcrumbList","@id":"https:\/\/beaconlab.us\/en\/publication\/alert-2026-133-an-actively-exploited-chain-of-zero-day-vulnerabilities-in-ivanti-connect-secure-enables-remote-execution-as-root-without-authentication\/#breadcrumblist","itemListElement":[{"@type":"ListItem","@id":"https:\/\/beaconlab.us\/en\/#listItem","position":1,"name":"Home","item":"https:\/\/beaconlab.us\/en\/","nextItem":{"@type":"ListItem","@id":"https:\/\/beaconlab.us\/en\/publication\/alert-2026-133-an-actively-exploited-chain-of-zero-day-vulnerabilities-in-ivanti-connect-secure-enables-remote-execution-as-root-without-authentication\/#listItem","name":"Alert 2026-133 An actively exploited chain of zero-day vulnerabilities in Ivanti Connect Secure enables remote execution as root without authentication"}},{"@type":"ListItem","@id":"https:\/\/beaconlab.us\/en\/publication\/alert-2026-133-an-actively-exploited-chain-of-zero-day-vulnerabilities-in-ivanti-connect-secure-enables-remote-execution-as-root-without-authentication\/#listItem","position":2,"name":"Alert 2026-133 An actively exploited chain of zero-day vulnerabilities in Ivanti Connect Secure enables remote execution as root without authentication","previousItem":{"@type":"ListItem","@id":"https:\/\/beaconlab.us\/en\/#listItem","name":"Home"}}]},{"@type":"Organization","@id":"https:\/\/beaconlab.us\/en\/#organization","name":"Beacon Lab","description":"CSIRT by Cybolt","url":"https:\/\/beaconlab.us\/en\/","telephone":"+528007374357","logo":{"@type":"ImageObject","url":"https:\/\/beaconlab.mx\/wp-content\/uploads\/2023\/12\/BeaconLab_V2-03.png","@id":"https:\/\/beaconlab.us\/en\/publication\/alert-2026-133-an-actively-exploited-chain-of-zero-day-vulnerabilities-in-ivanti-connect-secure-enables-remote-execution-as-root-without-authentication\/#organizationLogo"},"image":{"@id":"https:\/\/beaconlab.us\/en\/publication\/alert-2026-133-an-actively-exploited-chain-of-zero-day-vulnerabilities-in-ivanti-connect-secure-enables-remote-execution-as-root-without-authentication\/#organizationLogo"},"sameAs":["https:\/\/twitter.com\/BeaconLabMX","https:\/\/www.linkedin.com\/showcase\/beaconlabmx"]},{"@type":"WebPage","@id":"https:\/\/beaconlab.us\/en\/publication\/alert-2026-133-an-actively-exploited-chain-of-zero-day-vulnerabilities-in-ivanti-connect-secure-enables-remote-execution-as-root-without-authentication\/#webpage","url":"https:\/\/beaconlab.us\/en\/publication\/alert-2026-133-an-actively-exploited-chain-of-zero-day-vulnerabilities-in-ivanti-connect-secure-enables-remote-execution-as-root-without-authentication\/","name":"Ivanti Connect Secure: zero-day chain allows remote root","description":"Three-flaw chain actively exploited in Ivanti Connect Secure grants root without authentication. Update to 25.1.1.3, 25.1.3.1 or 22.8R2.6.","inLanguage":"en-US","isPartOf":{"@id":"https:\/\/beaconlab.us\/en\/#website"},"breadcrumb":{"@id":"https:\/\/beaconlab.us\/en\/publication\/alert-2026-133-an-actively-exploited-chain-of-zero-day-vulnerabilities-in-ivanti-connect-secure-enables-remote-execution-as-root-without-authentication\/#breadcrumblist"},"image":{"@type":"ImageObject","url":"https:\/\/beaconlab.us\/wp-content\/uploads\/2026\/10\/ivanti-logo-destacada.png","@id":"https:\/\/beaconlab.us\/en\/publication\/alert-2026-133-an-actively-exploited-chain-of-zero-day-vulnerabilities-in-ivanti-connect-secure-enables-remote-execution-as-root-without-authentication\/#mainImage","width":600,"height":600},"primaryImageOfPage":{"@id":"https:\/\/beaconlab.us\/en\/publication\/alert-2026-133-an-actively-exploited-chain-of-zero-day-vulnerabilities-in-ivanti-connect-secure-enables-remote-execution-as-root-without-authentication\/#mainImage"},"datePublished":"2026-10-30T18:09:34-06:00","dateModified":"2026-10-30T18:10:36-06:00"},{"@type":"WebSite","@id":"https:\/\/beaconlab.us\/en\/#website","url":"https:\/\/beaconlab.us\/en\/","name":"Beacon Lab","description":"CSIRT by Cybolt","inLanguage":"en-US","publisher":{"@id":"https:\/\/beaconlab.us\/en\/#organization"}}]},"og:locale":"en_US","og:site_name":"Beacon Lab - CSIRT by Cybolt","og:type":"article","og:title":"Ivanti Connect Secure: zero-day chain allows remote root","og:description":"Three-flaw chain actively exploited in Ivanti Connect Secure grants root without authentication. Update to 25.1.1.3, 25.1.3.1 or 22.8R2.6.","og:url":"https:\/\/beaconlab.us\/en\/publication\/alert-2026-133-an-actively-exploited-chain-of-zero-day-vulnerabilities-in-ivanti-connect-secure-enables-remote-execution-as-root-without-authentication\/","og:image":"https:\/\/beaconlab.us\/wp-content\/uploads\/2026\/10\/og-ivanti-2026-133-1200x630-1.png","og:image:secure_url":"https:\/\/beaconlab.us\/wp-content\/uploads\/2026\/10\/og-ivanti-2026-133-1200x630-1.png","article:published_time":"2026-10-31T00:09:34+00:00","article:modified_time":"2026-10-31T00:10:36+00:00","twitter:card":"summary_large_image","twitter:site":"@BeaconLabMX","twitter:title":"Ivanti Connect Secure: zero-day chain allows remote root","twitter:description":"Three-flaw chain actively exploited in Ivanti Connect Secure grants root without authentication. Update to 25.1.1.3, 25.1.3.1 or 22.8R2.6.","twitter:image":"https:\/\/beaconlab.us\/wp-content\/uploads\/2026\/10\/og-ivanti-2026-133-1200x630-1.png"},"aioseo_meta_data":{"post_id":"12328","title":"Ivanti Connect Secure: zero-day chain allows remote root","description":"Three-flaw chain actively exploited in Ivanti Connect Secure grants root without authentication. Update to 25.1.1.3, 25.1.3.1 or 22.8R2.6.","keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"custom_image","og_image_url":"https:\/\/beaconlab.us\/wp-content\/uploads\/2026\/10\/og-ivanti-2026-133-1200x630-1.png","og_image_width":"0","og_image_height":"0","og_image_custom_url":"https:\/\/beaconlab.us\/wp-content\/uploads\/2026\/10\/og-ivanti-2026-133-1200x630-1.png","og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":true,"twitter_card":"default","twitter_image_type":"custom_image","twitter_image_url":null,"twitter_image_custom_url":"https:\/\/beaconlab.us\/wp-content\/uploads\/2026\/10\/og-ivanti-2026-133-1200x630-1.png","twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"breadcrumb_settings":null,"limit_modified_date":false,"ai":null,"created":"2026-10-31 00:10:36","updated":"2026-10-31 01:38:14","seo_analyzer_scan_date":null,"focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"aioseo_breadcrumb":"<div class=\"aioseo-breadcrumbs\"><span class=\"aioseo-breadcrumb\">\n\t\t\t<a href=\"https:\/\/beaconlab.us\/en\/\" title=\"Home\">Home<\/a>\n\t\t<\/span><span class=\"aioseo-breadcrumb-separator\">\u00bb<\/span><span class=\"aioseo-breadcrumb\">\n\t\t\tAlert 2026-133 An actively exploited chain of zero-day vulnerabilities in Ivanti Connect Secure enables remote execution as root without authentication\n\t\t<\/span><\/div>","aioseo_breadcrumb_json":[{"label":"Home","link":"https:\/\/beaconlab.us\/en\/"},{"label":"Alert 2026-133 An actively exploited chain of zero-day vulnerabilities in Ivanti Connect Secure enables remote execution as root without authentication","link":"https:\/\/beaconlab.us\/en\/publication\/alert-2026-133-an-actively-exploited-chain-of-zero-day-vulnerabilities-in-ivanti-connect-secure-enables-remote-execution-as-root-without-authentication\/"}],"_links":{"self":[{"href":"https:\/\/beaconlab.us\/en\/wp-json\/wp\/v2\/publicacion\/12328","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/beaconlab.us\/en\/wp-json\/wp\/v2\/publicacion"}],"about":[{"href":"https:\/\/beaconlab.us\/en\/wp-json\/wp\/v2\/types\/publicacion"}],"version-history":[{"count":1,"href":"https:\/\/beaconlab.us\/en\/wp-json\/wp\/v2\/publicacion\/12328\/revisions"}],"predecessor-version":[{"id":12329,"href":"https:\/\/beaconlab.us\/en\/wp-json\/wp\/v2\/publicacion\/12328\/revisions\/12329"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/beaconlab.us\/en\/wp-json\/wp\/v2\/media\/12324"}],"wp:attachment":[{"href":"https:\/\/beaconlab.us\/en\/wp-json\/wp\/v2\/media?parent=12328"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}