October 31, 2026 Attackers Rooted Fully-Patched Ivanti VPNs: What the Connect Secure Zero-Day Chain Means for Remote Access in Your Practice
On October 13, 2026, security researchers at Volexity disclosed something that should make every practice owner pause before trusting “we’re fully patched” as a clean bill of health. Attackers had chained together three previously unknown flaws in Ivanti Connect Secure — one of the most widely deployed VPN appliances in business — to gain complete, unauthenticated root control of devices that were already running the latest updates. The intrusion began around October 3, targeted a fully patched appliance, and was deliberately quiet: the attackers deployed no malware and no web shell, the usual fingerprints investigators look for. CISA moved fast, adding the flaw (tracked as CVE-2026-104935) to its catalog of actively exploited vulnerabilities and ordering federal agencies to patch within days. For any dental office that reaches its systems remotely through a VPN, this is worth understanding.
What actually happened
A VPN appliance like Ivanti Connect Secure sits at the edge of a network and exists to let authorized people in from the outside — a staff member working from home, a doctor checking a schedule, an IT contractor doing remote maintenance. Because it is exposed to the internet by design, it is also one of the most attractive things on the network to attack. Volexity found that an attacker group chained three separate bugs: the first flaws let them run code on the appliance without ever logging in, and a final privilege-escalation flaw lifted that foothold all the way to root — total administrative control. “Unauthenticated” is the word that matters: no stolen password, no phishing, no insider. A device reachable from the internet was enough.
Why “fully patched” did not save them
The detail that unsettles seasoned administrators is that the targeted appliances were up to date. These were zero-days — flaws the vendor did not yet have fixes for when the attacks began. That is a reminder that patching, while essential, is not a force field. There is always a window between when attackers find a flaw and when a fix exists, and skilled groups live inside that window. It is the same uncomfortable trend we covered when AI-assisted exploit development began shrinking the time a practice has to patch. The takeaway is not to stop patching — it is to stop assuming the edge device is safe simply because it is current, and to build defenses that hold up even during that exposure window.
Why a rooted VPN is close to a worst-case breach
When an attacker compromises a single workstation, they have one workstation. When they gain root on the VPN appliance, they hold the device that all remote access flows through. From there they can watch and redirect traffic, harvest credentials as staff log in, and reach straight into the internal network the VPN was protecting — the practice-management server, imaging storage, and the patient records they hold. Worse, this attack was built to be silent, deploying nothing that would trip an alarm. That combination — deep access plus no visible trace — is exactly the quiet, long dwell time that turns a single flaw into a reportable breach of protected health information. It is the same lesson as recent attacks that target the perimeter device itself rather than the users behind it: compromise the gatekeeper, and everything it guards is exposed.
“But we’re just a dental office” — why you’re in scope
It is tempting to file nation-state-grade VPN exploits under someone else’s problem. They rarely stay that way. Once a flaw like this is public, the technique is reused by ordinary criminal groups within days, and automated scanners sweep the entire internet looking for any exposed appliance — a practice’s VPN answers those scans exactly as a hospital’s does. Attackers are not choosing you by name; they are choosing every reachable, unpatched gateway they can find, and a dental network holds something they can monetize: patient data and the leverage to freeze your schedule. Many practices stood up remote access quickly in recent years and have not revisited it since, which is precisely the kind of set-and-forget device these campaigns hunt for. The same remote-access doors keep showing up as the way in, a pattern we traced in this year’s dental ransomware breaches.
What to do this week
You do not need an enterprise security team to respond sensibly. You need a short, disciplined routine:
- Find out what VPN or remote-access appliance you run, and its version. If it is Ivanti Connect Secure, confirm against Ivanti’s advisory whether your version (the disclosure named 25.1.1.1 and prior, 25.1.2.2 and prior, and 22.8R2.4 and prior as affected) is fully covered by the October fixes — and apply them immediately if not.
- Prioritize by what is actually being exploited. This flaw is on CISA’s Known Exploited Vulnerabilities list — the free federal shortlist of bugs attackers are using right now. Anything your practice runs that appears there jumps to the front of the patch queue.
- Get management interfaces off the open internet. The admin page of a VPN, firewall or server should never be reachable from the public internet — restrict it to the local network or a tightly controlled path.
- Require multi-factor authentication on every remote-access account, so a stolen or leaked password alone cannot get someone in.
- Segment the network so imaging devices, the practice-management server and guest Wi-Fi sit in separate zones — if the edge is breached, segmentation limits how far an intruder can travel.
- Protect and test your recovery path. Keep backups isolated and verified, so a silent compromise cannot also destroy your ability to recover — the discipline in our server backup, patch and access checklist.
The real lesson: remote access needs an owner
The uncomfortable message from this disclosure is that the device meant to let your team in safely can be turned into the attacker’s own front door — quietly, without a stolen password, and without leaving the usual traces. The reassuring part is that remote-access security is mostly a management problem, not a budget one. A VPN that is inventoried, patched on a schedule, locked down to trusted access, protected with MFA, segmented, and actually monitored stops being the internet’s easiest target and becomes your network’s strongest point.
If you are not certain what remote-access appliance your practice uses, when it was last updated, or whether its admin interface is exposed to the internet, that uncertainty is the risk. Contact Compudent Systems for a review of your practice’s remote access and network edge: we will identify what is exposed, confirm it is patched and properly locked down, and set up the MFA, segmentation, logging and backup posture that keeps a single flaw from becoming a breach of your patients’ trust.
Sources & further reading:
- The Hacker News — Attacker Chains Three Ivanti Connect Secure Flaws for Unauthenticated Root Access (Volexity; UTA0576)
- Help Net Security — Attackers chained three Ivanti zero-days to gain root on fully patched VPN appliances
- Cybersecurity Dive — Hacker chained Ivanti Connect Secure flaws in stealthy exploitation
- CISA — Known Exploited Vulnerabilities Catalog
Related Reading
- The Gateway That Lets Your Team In Can Let Attackers In Too: Critical Check Point VPN Flaws (CVE-2026-85102 / 85103) and Your Practice
- The Way In Was Remote Desktop: What 2026’s Dental Ransomware Breaches Keep Showing Us
- Ransomware Gangs Are Now Through the Front Door: What the SonicWall SMA1000 VPN Attacks Mean for Dental Practices