NewsThe Hacker News
Attackers Chain Three Ivanti Connect Secure Flaws to Gain Unauthenticated Root Access
Linked advisories
- CVE-2026-111357Ivanti Connect Secure zero-day chain (CVE-2026-104935) exploited for root
- CVE-2026-111357Ivanti Connect Secure 22.
- CVE-2026-111357Ivanti Connect Secure: Schwachstelle ermöglicht Privilegieneskalation
- CVE-2026-111357Ivanti Connect Secure — Ivanti Connect Secure Missing Authentication for Critical Function Vulnerability
Affected vendors and products
More on Unauthenticated
Other advisories
- Highghsa:GHSA-494m-4556-wf5pimgproxy has out-of-bounds heap read/write in ICO loader BMP header reconstruction that allows unauthenticated remote worker crash
- Not ratedosv:GHSA-494m-4556-wf5pimgproxy has out-of-bounds heap read/write in ICO loader BMP header reconstruction that allows unauthenticated remote worker crash
- Not ratedosv:GHSA-mmq5-xm89-9pfgimgproxy has unbounded memory allocation in ICO loader that allows unauthenticated memory-exhaustion DoS via crafted data_size field
- Highghsa:GHSA-mmq5-xm89-9pfgimgproxy has unbounded memory allocation in ICO loader that allows unauthenticated memory-exhaustion DoS via crafted data_size field
- Not ratedosv:CVE-2026-63396Coop has a data leak via unauthenticated GraphQL Query.allOrgs
- Not ratedosv:CVE-2026-63399Coop: Unauthenticated org provisioning via GraphQL Mutation.createOrg
- Not ratedosv:CVE-2026-63377TAKO AI Agent for Okta: Unauthenticated first-run administrator takeover
- Not ratedosv:CVE-2026-62277LubeLogger: IDOR in PrintRecordStickers Allows Unauthenticated Cross-User Vehicle Record Exfiltration
Other news entries
- Critical Linux kernel flaw allows remote root attacks on MPTCP serversNewsBleepingComputer
- Linux kernel exploit enables remote root attacks on MPTCP serversNewsBleepingComputer
- Anthropic AI model finds Linux kernel bug that leads to remote root accessNewsCSO Online
- Fresh WordPress Vulnerability in Attackers’ CrosshairsNewsSecurityWeek
- Max-Severity GitLab Vulnerability Exploited Against Alpine LinuxNewsSecurityWeek
- Cisco Finesse Server-Side Request Forgery VulnerabilityNewsCisco PSIRT
- Attackers Exploit Second Cisco Firewall VPN Zero-Day Since AugustNewsSecurityWeek
- Cisco Catalyst SD-WAN Controller Authentication Bypass VulnerabilityNewsCisco PSIRT
Source: https://thehackernews.com/2026/10/attackers-chain-three-ivanti-connect.html
ID