WASHINGTON, Oct. 16 -- The VPN appliance that stands between a company's staff and its internal network was fully patched, and attackers got in anyway. That is the finding in a report published Tuesday by the security firm Volexity, which says an actor it tracks as UTA0576 chained three zero-day flaws in Ivanti Connect Secure to run commands as root without a password.

The compromised device ran version 22.8R2.4, then the newest release, and Volexity dates the exploitation to October 3. Ivanti shipped a fix Tuesday for the authentication bypass and remote code execution flaw, tracked as CVE-2026-104935. The third, a privilege escalation bug, is still unpatched, with a fix due "in the coming weeks," according to Volexity. For ten days bef...