Ivanti Zero-Day Chain Enabled Root Access to Fully Patched VPN Appliances
Summary
Ivanti says attackers exploited a zero-day chain in Connect Secure VPN appliances for root-level access. Patches address two flaws; a third remains unpatched. Attackers stole credentials and limited Active Directory metadata.
Key points
- CVE-2026-104935 is an authentication bypass that enables remote, unauthenticated command execution; Ivanti reports exploitation affecting a limited number of customers.
- Volexity says actor UTA0576 chained three zero-days to gain unauthenticated root-level code execution on a fully patched appliance.
- Ivanti patched two flaws in ICS versions 22.8R2.5, 25.1.1.2, 25.1.3.0, and 25.1.3.1; the third, a privilege-escalation flaw, remains unpatched.
- Volexity found evidence of exploitation beginning October 3, involving credential theft, data exfiltration, network reconnaissance, and log tampering.
- The attackers stole domain credentials and limited Active Directory metadata, and searched for LAPS passwords and BitLocker recovery keys.
- The activity was detected and disrupted before the attackers' ultimate goals were clear; Volexity found no backdoor or web shell on the appliance.
Article Details
- Vulnerability Types
- Authentication bypass
- Remote code execution
- Privilege escalation
- Severity
- High (CVE-2026-104935); severity of the separate privilege-escalation vulnerability not stated.
- Affected Versions
- Ivanti Connect Secure (ICS) appliances; affected version range not specified.
- Exploitation Status
- active
- Exploit Availability
- unknown
- Patch Status
- partial