Ivanti Connect Secure zero-day chain gave attackers unauthenticated root; one flaw still unpatched

Three chained zero-days, one open fix

Security firm Volexity disclosed on October 13, 2026 that an attacker chained three previously unknown vulnerabilities in Ivanti Connect Secure to run commands as root on a VPN appliance without ever presenting credentials. The appliance Volexity examined ran version 22.8R2.4 and was fully patched when it was compromised. The attacker, tracked as UTA0576, began exploiting the flaws on October 3, ten days before public disclosure. Ivanti has acknowledged limited exploitation in the wild and urged customers on affected versions to act immediately, though neither the vendor nor Volexity has said how many organizations were affected.

How the chain works

According to Volexity, two of the flaws — an authentication bypass and a remote code execution bug — are tracked together as CVE-2026-104935 and allow an unauthenticated attacker to execute code as the appliance's cgi-server user. The third flaw escalates that access to root. Volexity reported all three issues to Ivanti.

Ivanti rates CVE-2026-104935 at 8.6 on the CVSS scale. In its entry for the CVE, CISA lists the exploitation status as active and the technical impact as total.

Ivanti has shipped fixes for the first two flaws, but the privilege escalation remains unpatched, with a fix promised for a future release in the coming weeks. Volexity's report does not say what residual risk the open flaw poses on an appliance where the other two have been fixed.

Which versions are affected

The CVE record Ivanti filed gives these boundaries for Connect Secure: versions before 25.1.3.0 are affected; 22.7R2.14 and earlier are not; and 22.8R2.5, 25.1.3.0 and 25.1.3.1 are listed as unaffected. Release notes for 25.1.3.0 date to July 2026, so deployments already on that release sit outside the affected range. The compromised appliance in Volexity's investigation ran 22.8R2.4, one step below the unaffected 22.8R2.5.

Why the vendor's integrity check misses it

Ivanti advises customers to upgrade and to run its Integrity Checker Tool on a regular basis. Volexity says the tool does not detect this intrusion. The exploit modifies library code only in memory and restores the configuration data it touches, and the attacker took additional steps to stay hidden. No backdoor or web shell was left on the appliance — UTA0576 reran the full exploit chain each time it wanted to execute a command. The practical consequence is that a clean Integrity Checker Tool result does not rule out compromise; Volexity says confirming an intrusion requires forensic investigation, including network and memory forensics.

What the attacker did with root

In the single incident Volexity investigated, the VPN appliance was the entry point and the directory behind it was the target. The attacker stole stored credentials from the appliance, including LDAP domain credentials, then searched Active Directory for passwords and ran password-spraying attacks against domain accounts. Volexity assesses with low confidence that UTA0576's motive is criminal rather than espionage — a rating that reflects the limited evidence available from one case.

Indicators published from that intrusion include a large number of requests to the URL path /dana-na/auth/url_default/welcome.cgi, an X-DSCGI-PATH HTTP header whose value did not match the URL path on those requests, the directory /data/.icscap/, and the IP address 108.165.147[.]64. All four come from one incident, and Volexity has not said whether other intrusions share the same paths or infrastructure.

Related advisories and open questions

The same Ivanti advisory covers two other flaws, each rated 9.9 out of 10: CVE-2026-106042 in Xtraction before version 2026.4, and CVE-2026-109412 in Neurons Patch for Intune. Ivanti says it is not aware of either being exploited.

Several questions remain open in the public record. No temporary workaround has been published for customers who cannot upgrade while the privilege escalation fix is pending. Neither Volexity nor Ivanti has said whether upgrading evicts an attacker who has already gained access. There is no victim count, and the privilege escalation flaw has not been assigned a CVE identifier.

Why it matters

The core lesson is uncomfortable for defenders: a fully patched edge appliance was taken to root without credentials, exploitation started ten days before public disclosure, the vendor's own integrity tool cannot see the technique, and one of the three flaws is still unfixed. The blast radius also extended well past the appliance, reaching domain credentials and Active Directory accounts. Organizations running affected Connect Secure versions should upgrade to a fixed release immediately, treat a clean integrity check as insufficient on its own, and consider forensic review — particularly memory and network analysis — for appliances that show the published indicators.