They Got Root on a Fully Patched Ivanti VPN and the Integrity Checker Said Everything Was Fine
- Created
- 10 Nov 2026
- Last reply
- 9 minutes ago
- Replies
- 0
- Views
- 0
- Reactions
- 0
Discussion of the blog article They Got Root on a Fully Patched Ivanti VPN and the Integrity Checker Said Everything Was Fine.
Volexity caught an attacker chaining zero-days into unauthenticated root on an Ivanti Connect Secure appliance running the latest build. The payload never touched disk, commands rode in over the same HTTPS requests as the exploit, and Ivanti's Integrity Checker reported no modifications.
Discussion thread — share findings, corrections and follow-ups below.