Unauthenticated attacker chained three Ivanti Connect Secure zero-days for root access on fully patched VPN

TLDR

• UTA0576, tracked by Volexity, chained three zero-days to gain root-level code execution on a fully patched Ivanti Connect Secure VPN.¹
• Edge VPN devices with a history of exploitation remain worth a dedicated zero-day chain to attackers.¹
• The privilege-escalation flaw has no patch yet, and Ivanti says a fix is coming "over the coming weeks".²

Update, 15 October, what changed: CISA added CVE-2026-104935 to its Known Exploited Vulnerabilities catalogue on 13 October, giving federal civilian agencies until Friday 16 October to mitigate it, and issued a separate advisory urging all organisations with Connect Secure appliances to update immediately and check for compromise.⁴⁵ CISA warned that Ivanti's Integrity Checker Tool may not detect exploitation because the attacker's commands run in memory, so organisations need network and memory forensics.⁴⁶ For compromised appliances it advises backing up the configuration, factory-resetting and upgrading (or rebuilding virtual instances), restoring the configuration, then resetting all account passwords and reissuing stored certificates, API keys and licence server credentials.⁴

The exploitation timeline has moved earlier: threat intelligence firm Defused says it first saw attacks on 1 October on its honeypots and customer instances, two days before the 3 October activity Volexity traced.⁴⁶ Cybersecurity Dive reports that Ivanti says it had identified part of the vulnerability through its internal product security programme and patched it in the July release of 25.1.3.0, whereas BleepingComputer lists 25.1.3.0 among the versions released on Tuesday.⁴⁶ The Record reports Ivanti is still working on a fix for the third, privilege-escalation flaw, and that this is the sixth Ivanti vulnerability added to CISA's catalogue in 2026.⁵ Shadowserver tracks more than 5,600 internet-exposed hosts with Connect Secure fingerprints, though it cannot say how many are patched or are honeypots.⁴

Volexity said it discovered the exploit chain on 5 October 2026 while investigating suspected malicious activity at a Network Security Monitoring customer, tracing the intrusion to an Ivanti Connect Secure appliance that was fully patched at version 22.8R2.4.¹ Forensic analysis of memory and disk images, since the attacker had wiped Ivanti debug logs and Linux audit logs, showed UTA0576 had strung together an authentication bypass, a remote-code-execution flaw and a privilege-escalation bug to reach unauthenticated root access without ever triggering a separate command-and-control channel.¹

Ivanti has shipped fixes for the authentication-bypass and RCE components, tracked together as CVE-2026-104935, in ICS versions 22.8R2.5, 25.1.1.2, 25.1.3.0 and 25.1.3.1.² The privilege-escalation flaw used to reach root remains unpatched. Volexity assessed with high confidence that the campaign was detected and disrupted before the attacker achieved its broader objective, likely preparation for lateral movement, and assessed with low confidence that UTA0576 is criminally motivated rather than state-backed, alongside medium-confidence evidence that the group used large language models to help develop the exploit chain and automate post-exploitation steps.¹³

Why it matters: the appliance was fully patched against every previously known Connect Secure flaw, yet an attacker still reached root, underscoring that edge VPN devices with a history of exploitation remain a target worth a dedicated zero-day chain rather than a one-off bug.