The appliance was fully patched when they got in, and one link in the chain still is not fixed
2026-10-14Security
Volexity documented a three-stage zero-day chain against Ivanti Connect Secure. Two stages were patched on 13 October under one identifier. The third, a privilege escalation to root, is still open — and Ivanti's own integrity checker does not see any of it.