Hackers chained three zero-days to hit fully patched Ivanti VPN devices
Attackers gained root-level access without credentials, leaving no malware or backdoor behind. Ivanti has patched two of the three flaws; a privilege-escalation fix is still pending, and CISA has ordered US federal agencies to act by 16 October 2026.
3 min read