Ivanti Connect Secure zero-day chain enables root access; patches released for some flaws

TL;DR what: An attacker tracked as UTA0576 chained three zero-day flaws in Ivanti Connect Secure to run commands as root on a fully patched appliance without authenticating. impact: In the one incident Volexity investigated, the attacker stole stored credentials including LDAP domain credentials, searched Active Directory for passwords and ran password-spraying attacks. fix: Ivanti fixed the authentication bypass and remote code execution flaws (CVE-2026-104935) and lists 22.8R2.5, 25.1.3.0 and 25.1.3.1 as unaffected, while the privilege escalation fix is due in a future release. who: Organizations running Ivanti Connect Secure versions before 25.1.3.0, other than 22.7R2.14 or prior and 22.8R2.5, are in the affected range. An attacker chained three zero-day flaws in Ivanti Connect Secure to run commands as root on a fully patched VPN appliance without logging in. Security firm Volexity disclosed the chain on October 13, 2026. Ivanti has released fixes for two of the three flaws. The third, a privilege escalation, is still unpatched. Volexity found the attack on one customer's appliance running version 22.8R2.4, which was fully patched at the time. The attacker, tracked as UTA0576, began exploiting it on October 3, ten days before public disclosure. Ivanti says it is aware of "limited exploitation in the wild" and has told customers on affected versions to "act immediately." Neither company said how many customers were attacked. How the chain works The first two flaws are an authentication bypass and a remote code execution flaw, tracked together as CVE-2026-104935. Combined, they let an unauthenticated attacker run code as the appliance's cgi-server user. The third flaw is a privilege escalation that raises that access to root, according to Volexity, which reported all three flaws to Ivanti. Ivanti rates CVE-2026-104935 at 8.6 out of 10 on the CVSS scale. In its own entry in the CVE record, CISA marks exploitation as "active" and the technical impact as "total." ⚠️ One flaw in the chain is still open — Ivanti is working on a fix for the privilege escalation flaw, which Volexity says will come "in a future release in the coming weeks." Volexity's report does not say what risk that flaw carries on an appliance where the first two are fixed. Affected versions The CVE record Ivanti filed gives the version boundaries for Connect Secure: Affected: Connect Secure "before version 25.1.3.0" Not affected: version 22.7R2.14 "or prior" Listed as unaffected: versions 22.8R2.5, 25.1.3.0 and 25.1.3.1 The release notes for 25.1.3.0 are dated July 2026, so customers already on that version are outside the range the CVE record gives. The appliance in Volexity's case ran 22.8R2.4, and the CVE record lists 22.8R2.5 as unaffected. Ivanti's security advisory carries the full detail on affected versions and fixes. Why the Integrity Checker Tool misses it Ivanti tells customers to upgrade and to run its Integrity Checker Tool regularly. Volexity says that tool does not detect this chain. The exploit changes library code only in memory and restores the configuration data it alters, and the attacker took additional steps to stay hidden from the tool. The attacker also left no backdoor or web shell behind. Instead, UTA0576 reran the entire exploit chain for each command. For defenders, the consequence is that a clean Integrity Checker Tool result does not rule out compromise by this chain. Volexity says confirming a compromise takes forensic investigation, including network and memory forensics. Indicators from the investigated incident Volexity published these signs from the single incident it investigated: URL path: /dana-na/auth/url_default/welcome.cgi, requested in large numbers HTTP header: X-DSCGI-PATH on those requests, with a value that does not match the URL path Directory: /data/.icscap/ IP address: 108.165.147[.]64, the host the attacker used All four come from one intrusion. Volexity has not said whether other incidents share the same path, directory or infrastructure. What the attacker did with root The VPN appliance was the entry point, and the directory behind it was the objective. In the incident Volexity investigated, the attacker stole stored credentials from the appliance, including LDAP domain credentials. UTA0576 then searched Active Directory for passwords and ran password-spraying attacks against its accounts. Volexity assessed with low confidence that UTA0576's motive is criminal, not espionage. The low confidence rating matters: the attribution rests on limited evidence from one case. What the public record does not answer — Volexity's report and Ivanti's post do not name a temporary workaround for customers who cannot upgrade yet. They do not say whether upgrading removes access an attacker has already gained. They do not give a victim count, and no CVE identifier has been cited for the privilege escalation flaw. Vendor guidance and the other fixes in the same post Ivanti's guidance for Connect Secure is to upgrade to a fixed version and run the Integrity Checker Tool regularly. No interim mitigation has been published for the pending privilege escalation fix. The same Ivanti post covers two other products, each with a flaw Ivanti rates 9.9 out of 10: CVE-2026-106042 in Xtraction before version 2026.4, and CVE-2026-109412 in Neurons Patch for Intune. Ivanti said it is not aware of either flaw being exploited. The takeaway for security leaders is narrow and concrete. A fully patched edge appliance was rooted without credentials, exploitation began ten days before disclosure, the vendor's own integrity tool does not detect the technique, and one of the three flaws remains unpatched. In the one confirmed case, the damage extended past the appliance to domain credentials and Active Directory accounts. Originally published on RedEye Threat Intelligence.

CVE-2026-104935 affects Ivanti Connect Secure and it can be exploited for unauthenticated remote code execution with elevated privileges.  The post Ivanti Zero-Day Chain Gave Attackers Root Access to Fully Patched VPN appeared first on SecurityWeek.

An attacker chained three zero-day flaws in Ivanti Connect Secure, a VPN appliance, to run commands as root without logging in, security firm Volexity said on October 13. Ivanti has released fixes for two of the flaws and told customers on affected versions to "act immediately." A fix for the third is still pending, according to Volexity. Volexity, which reported the flaws to Ivanti,

Ivanti urged customers on Tuesday to immediately patch an actively exploited zero-day vulnerability in the Ivanti Connect Secure (ICS) remote access gateway. [...]