Volexity documented attackers chaining Ivanti Connect Secure auth bypass/RCE (CVE-2026-104935) with privilege escalation (CVE-2026-111357) to gain root. CISA added 104935 to KEV Oct. 13, not 111357. For admins: review Ivanti updates and investigate affected gateways. Patching can't rule out earlier compromise. https://www.volexity.com/blog/2026/10/13/a-series-of-unauthenticated-events-chained-exploitation-of-ivanti-connect-secure-zero-days/ #Cybersecurity #Infosec #MSP #VPN