Ivanti Connect Secure zero-day chain gives attackers root

Ivanti Connect Secure zero-day chain gives attackers root

An unknown threat actor has been chaining three vulnerabilities in Ivanti Connect Secure (ICS) VPN appliances to get root access, steal credentials and map victims' networks. The attacks worked against appliances that were fully patched at the time.

Volexity discovered the activity in the first week of October 2026 and tracks the attacker as UTA0576. The compromised appliance was running version 22.8R2.4, the latest available release at that point.

Ivanti says only a limited number of customers were affected when the issue was disclosed, and that it is helping those organizations.

Three flaws, one chain

Volexity says the chain starts with an authentication bypass in welcome.cgi. A file write vulnerability in wu.cgi follows. The last step is a privilege escalation flaw in the way the ICS dsinvoked broker trusts DSCache configuration data. That flaw lets an attacker run commands as root.

With root access, UTA0576 had full control of the targeted devices. The attackers used it to:

  • extract credentials stored on the appliance
  • exfiltrate some Active Directory metadata
  • collect local admin passwords and BitLocker recovery keys
  • steal configuration data
  • capture LDAP traffic passing through the compromised appliance
  • tamper with logs, delete temporary execution artifacts and otherwise clean up after themselves

According to Defused Cyber, the earliest confirmed attack took place on October 1.

Crime or espionage?

Volexity has low confidence that UTA0576 is financially motivated rather than spying, and bases that view on who was targeted. Because the intrusion was detected and stopped, the researchers could not tell what the attackers ultimately wanted.

They are more certain about the direction of travel. Volexity assesses with high confidence that the attacker's actions were preparation for lateral movement and a wider compromise of the victim's network.

Patch available for part of the chain

Ivanti has released a fix for the authentication bypass and remote code execution vulnerability, tracked as CVE-2026-104935. A fix for the privilege escalation part of the chain is still in progress.

The company says it had already found part of the problem through its own product security program. It patched that part in release 25.1.3.0 in July and was backporting the fix to its other supported versions when the attacks began.

Ivanti tells customers to upgrade to a fixed release, check their systems against the indicators of compromise published by Volexity, and run the ICS Integrity Checker Tool on a regular basis. The tool looks for unexpected changes to files on disk.

Volexity warns that the tool will not help much here. The exploit chain patches library code only in memory and restores the configuration store data, so the checker sees nothing wrong. Volexity says forensic investigation is needed to find signs of exploitation.

CISA, the US Cybersecurity and Infrastructure Security Agency, gave similar advice. It added CVE-2026-104935 to its Known Exploited Vulnerabilities catalog and ordered US federal civilian agencies to fix the flaw and carry out forensic triage by October 16, 2026. Organizations that find evidence of compromise should follow Ivanti's recovery steps.

Why It Matters

This case shows that "fully patched" does not mean safe on edge devices. The attackers beat a current release, and they covered their tracks well enough to avoid the vendor's own integrity tool. Admins who rely on that tool for reassurance should not do so this time.

The attacks also fit a familiar pattern. Remote access gear keeps attracting attackers, as recent cases involving the SonicWall SMA1000, a Citrix NetScaler SAML zero-day and compromised Fortinet devices show.

There are two things to watch. The first is when Ivanti ships the privilege escalation fix. The second is whether more victims come forward. The stolen BitLocker keys and admin passwords suggest that follow-on intrusions are possible.