Ivanti Connect Secure zero-day chain reaches root access
Attackers chained three zero-day vulnerabilities in Ivanti Connect Secure to run commands as root without authenticating to the VPN appliance, security firm Volexity said on October 13. Ivanti has released fixes for two parts of the chain, while a patch for the privilege-escalation flaw is still pending.
Volexity identified the activity on a customer appliance that was fully patched and running Connect Secure version 22.8R2.4. The firm tracks the attacker as UTA0576 and said exploitation began on October 3. Ivanti said it was aware of limited exploitation in the wild and urged customers on affected versions to act immediately.
Three flaws create an unauthenticated route to root
The first two vulnerabilities are an authentication bypass and remote code execution issue jointly tracked as CVE-2026-104935. Volexity said they allow an attacker to execute code as the appliance's cgi-server user. A third, unpatched privilege-escalation vulnerability then raises that access to root.
Ivanti rates CVE-2026-104935 at 8.6 out of 10 under CVSS. In its CVE entry, the U.S. Cybersecurity and Infrastructure Security Agency marks exploitation as active and the technical impact as total.
The CVE record lists Connect Secure releases before version 25.1.3.0 as affected. Version 22.7R2.14 or earlier is listed as not affected, while 22.8R2.5, 25.1.3.0 and 25.1.3.1 are identified as unaffected. Ivanti is working on the patch for the remaining privilege-escalation issue and, Volexity said, expects it in a future release in the coming weeks.
Detection requires more than the integrity utility
Ivanti advises customers to upgrade and run its Integrity Checker Tool regularly. Volexity said the tool does not detect this chain because the exploit changes library code only in memory and restores the configuration data it modifies. The attacker also took steps intended to remain hidden from the utility.
Volexity said confirming a compromise requires forensic investigation, including network and memory forensics. In the incident it examined, useful signals included large numbers of requests to /dana-na/auth/url_default/welcome.cgi, an X-DSCGI-PATH header whose value did not match the URL path, the /data/.icscap/ directory, and the IP address 108.165.147[.]64.
Credential theft followed exploitation
The attacker stole stored credentials, including LDAP domain credentials, searched Active Directory for passwords and conducted password-spraying attacks against accounts. Volexity found no web shell or backdoor; instead, the actor reran the complete exploit chain for every command.
Neither Ivanti nor Volexity described a temporary workaround for organizations that cannot yet upgrade, and neither said whether an upgrade removes access already obtained by an intruder. For businesses operating affected Connect Secure versions, the immediate implication is to upgrade to an unaffected release, use the integrity checks, and escalate suspicious indicators to network and memory forensic investigation rather than treating a clean tool result as proof of safety.