# Volexity reveals three-flaw Ivanti attack chain with root access

_Published Tuesday, October 13, 2026 at 3:27 PM EDT · Security · Latest · Tier 1 — Major_

![Volexity reveals three-flaw Ivanti attack chain with root access — Primary](https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhZSH26NsXmSsQGaAbhNyJLMaBQKFCmabIbFZ_yi2sUGXjHQOVztQEQfXLarEAx1Fl9lRwGAryBE4zZEooJ4cochODcB4x8wQnPl3MRWiyBcpyEV6i8VPxvwcLHmShQVZVhuOcTjMXRhHAlx4Y0Uo85c74EVU4cea84YgXju02I9jlNzcGOFtLfa_am82Q/s1700-nu-rw-lo-l85-e365/ivanti-hack.jpg)

An attacker chained three previously unknown Ivanti Connect Secure flaws to execute commands with root privileges without logging in, Volexity disclosed October 13. The finding adds a privilege-escalation flaw to the authentication bypass and remote code execution flaws covered by Ivanti's fixes; the third fix is pending.

Volexity found the attack on a customer's appliance that was fully patched when exploitation began October 3. The attacker stole stored credentials, including LDAP domain credentials, and searched Active Directory for passwords.

Ivanti urged affected customers to upgrade. Volexity said Ivanti's Integrity Checker Tool misses this chain because it alters library code in memory and restores changed configuration data; confirming compromise requires forensic investigation.

## Sources

- [The Hacker News](https://thehackernews.com/2026/10/attacker-chains-three-ivanti-connect.html)

---
Canonical: https://techandbusiness.org/newswire/oHMmxtxiINNbLj2Bo6E0MW
Published: 2026-10-13T19:27:08.462Z
Story chronology: 2026-10-13T17:33:11.000Z
Retrieved: 2026-10-13T21:51:13.964Z
Publisher: Tech & Business (techandbusiness.org)