# Ivanti attack chain includes unpatched privilege escalation flaw

_Published Monday, October 19, 2026 at 1:19 PM EDT · Security · Latest · Tier 2 — Notable_

![Ivanti attack chain includes unpatched privilege escalation flaw — Primary](https://socprime.com/wp-content/uploads/Image_bg-1.png)

A threat actor tracked as UTA0576 chained three vulnerabilities in Ivanti Connect Secure appliances to gain unauthenticated root access, SOC Prime reported, citing a Volexity investigation. The chain combined authentication bypass, remote code execution and an unpatched privilege escalation flaw.

The attacker used staged payloads held in memory and tampered with logs, complicating forensic analysis. SOC Prime advises upgrading to version 22.8R2.5 or later, or moving to the 25.1 code line, while continuing to monitor for compromise. Ivanti's Integrity Checker Tool may miss in-memory modifications.

## Sources

- [socprime.com](https://socprime.com/active-threats/cve-2026-104935-ivanti-connect-secure-zero-day-exploited-in-chained-attacks/)

---
Canonical: https://techandbusiness.org/newswire/QDXsu2P1xKfQRSNLSVNmjd
Published: 2026-10-19T17:19:22.203Z
Story chronology: 2026-10-19T17:00:45.000Z
Retrieved: 2026-10-19T20:17:43.688Z
Publisher: Tech & Business (techandbusiness.org)