Threats tagged 'root access'

Ivanti has released emergency security updates after attackers exploited a chain of three zero-day vulnerabilities in Connect Secure VPN appliances to gain root-level access without authentication. The attack began on October 3, targeting an appliance running version 22.8R2.4. Two vulnerabilities are tracked as CVE-2026-104935 with a CVSS score of 8.6, involving an authentication bypass and remote code execution through manipulated CGI requests and malicious file uploads. A third unpatched vulnerability allows privilege escalation to root by manipulating a privileged service through memory modification. While patches address the authentication bypass and RCE, the privilege escalation flaw remains unresolved. CISA added the vulnerability to its KEV catalog with an October 16 remediation deadline for federal agencies.