Ivanti Connect Secure Zero-Day: 3 Flaws Chain to Root [2026]

Two of the most widely deployed remote-access platforms in corporate networks are under active attack at the same time. On October 13, 2026, the Cybersecurity and Infrastructure Security Agency (CISA) warned that a new Ivanti Connect Secure zero-day, tracked as CVE-2026-104935, is being exploited in the wild to run commands as root without a login. Nine days earlier, on October 4, Citrix had already pushed emergency patches for CVE-2026-88779, a NetScaler flaw that attackers were using in targeted denial-of-service campaigns. Together, the two incidents mark the latest round in a now-familiar cycle: enterprise edge appliances, the boxes that sit between the open internet and the corporate network, keep becoming the easiest way in.