NewsThe Hacker News
Attackers Chain Three Ivanti Connect Secure Flaws to Gain Unauthenticated Root Access
Linked advisories
- CVE-2026-111357Ivanti Connect Secure zero-day chain (CVE-2026-104935) exploited for root
- CVE-2026-111357Ivanti Connect Secure Multiple Vulnerabilities
- CVE-2026-111357Ivanti Connect Secure 22.
- CVE-2026-111357Ivanti Connect Secure: Schwachstelle ermöglicht Privilegieneskalation
- CVE-2026-111357Ivanti Connect Secure — Ivanti Connect Secure Missing Authentication for Critical Function Vulnerability
Affected vendors and products
More on Unauthenticated
Other advisories
- CriticalCVE-2026-73578Apache OFBiz 24.09.08 fixes 46 CVEs, including unauthenticated RCE and login bypass
- CriticalCVE-2026-121640WatchGuard AuthPoint Gateway: forged auth results, replayed admin actions, MITM and unauthenticated DoS (CVE-2026-121637 to CVE-2026-121640)
- Not ratedosv:CVE-2026-121736NocoDB 0.300.0 before 2026.08.0 Unauthenticated OAuth Authorization Code Creation
- Not ratedosv:CVE-2026-63482Yeti: Unauthenticated Access to Full Audit Timeline Discloses All Threat Intelligence Data
- Not ratedosv:GHSA-m3qr-fvp4-78xjArc has unauthenticated application log disclosure via `/api/v1/logs`
- Lowghsa:GHSA-m3qr-fvp4-78xjArc has unauthenticated application log disclosure via `/api/v1/logs`
- Not ratedosv:CVE-2026-121555Foxel through 2.4.0 Unauthenticated File Read via /api/fs/stream and /api/fs/thumb
- CriticalCVE-2026-121802Better Auth's Expo plugin let unauthenticated attackers take over accounts (CVE-2026-121802)
Other news entries
- Cisco Identity Services Engine Authorization Bypass VulnerabilityNewsCisco PSIRT
- Cisco Unified Communications Manager Cross-Site Scripting VulnerabilityNewsCisco PSIRT
- Critical Rails Flaw Lets Attackers Write Server Files via Crafted ImageMagick UploadsNewsThe Hacker News
- Cisco Secure Email Gateway SQL Injection VulnerabilityNewsCisco PSIRT
- Critical Langflow Flaws Could Let Unauthenticated Attackers Run Code on ServersNewsThe Hacker News
- Critical Linux kernel flaw allows remote root attacks on MPTCP serversNewsBleepingComputer
- Linux kernel exploit enables remote root attacks on MPTCP serversNewsBleepingComputer
- Rapid7 Analysis: Unauthenticated File Upload to RCE in BeyondTrust Remote Support (CVE-2026-102764)NewsRapid7
Source: https://thehackernews.com/2026/10/attackers-chain-three-ivanti-connect.html
ID