Ivanti Connect Secure zero-day chain gives attackers root
An unknown threat actor has been chaining three vulnerabilities in Ivanti Connect Secure (ICS) VPN appliances to get root access, steal credentials and map victims' networks. The attacks worked against appliances that were fully patched at the time.
Volexity discovered the activity in the first week of October 2026 and tracks the attacker as UTA0576. The compromised appliance was running version 22.8R2.4, the latest available release at that point.
Ivanti says only a limited number of customers were affected when the issue was disclosed, and that it is helping those organizations.
Three flaws, one chain
Volexity says the chain starts with an authentication bypass in welcome.cgi. A file write vulnerability in wu.cgi follows. The last step is a privilege escalation flaw in the way the ICS dsinvoked broker trusts DSCache configuration data. That flaw lets an attacker run commands as root.