An attacker chained three zero-day vulnerabilities in Ivanti Connect Secure to gain root access on a fully patched VPN appliance, according to Volexity. Ivanti shipped fixes for two of the flaws, but the privilege escalation that delivers root remains unpatched on updated appliances.
UTA0576 Compromised a Fully Patched Connect Secure Appliance
Volexity found a previously undocumented actor, tracked as UTA0576, exploiting the chain against one customer’s Ivanti Connect Secure appliance running version 22.8R2.4 in early October. The appliance was fully patched at the time. Ivanti says a limited number of customers were compromised.
Reports differ on when exploitation began. Volexity says October 3. Defused Cyber and Volexity’s Sean Koessel say the earliest confirmed instance was October 1 and that activity may reach back to late September.
How the Three-Flaw Chain Reaches Root
The chain starts with an authentication bypass in welcome.cgi and a file-write flaw in wu.cgi. Together they are tracked as CVE-2026-104935, rated high with a CVSS score of 8.6 according to Security Affairs, and they give code execution as the cgi-server user. The third step is a privilege escalation in how the Connect Secure dsinvoked broker trusts DSCache configuration data, which hands the attacker root.
Credential Theft and Active Directory Reconnaissance After Exploitation
Once inside, UTA0576 stole stored credentials, including LDAP domain credentials, and exfiltrated limited Active Directory metadata. The actor used a custom tool to hunt for LAPS passwords and BitLocker recovery keys, ran password spraying, tested credentials with a custom Kerberos tool, scanned the network, collected appliance configuration and parsed authentication logs.
The actor left no backdoor or web shell. Instead it reran the exploit chain for each command it wanted to execute. Volexity also observed log tampering. Volexity assesses with low confidence that the motive was criminal rather than espionage, and says the operation was disrupted before the actor’s final goals became clear.
Integrity Checker Tool Cannot See the Exploit
Ivanti’s Integrity Checker Tool does not detect this chain. The exploit alters library code only in memory, so confirming a compromise requires network and memory forensics. Administrators who rely on the tool’s clean result alone have no assurance that an appliance is uncompromised.
Which Ivanti Releases Are Fixed and Which Flaw Stays Open
Ivanti patched the authentication bypass and code execution flaws in Connect Secure 22.8R2.5, 25.1.1.2, 25.1.3.0 and 25.1.3.1. The privilege escalation remains unpatched, and Ivanti has promised a fix “in the coming weeks.” Versions 22.7R2.14 and earlier are not affected. No temporary workaround has been published.
Ivanti Says It Found Part of the Bug Internally
Ivanti says it identified part of the flaw on its own and fixed it in version 25.1.3.0 in July. The company says it was backporting that fix to other release lines when exploitation began, and that the situation did not meet its threshold for an out-of-band release. Volexity’s report shows the chain working against an appliance that was fully patched, so the partial July fix did not protect it.
CISA Adds CVE-2026-104935 to the KEV Catalog
CISA added CVE-2026-104935 to its Known Exploited Vulnerabilities catalog on October 13, the day Volexity published its report and Ivanti issued its advisory and patches. Federal agencies have until October 16 to apply the fixes.
The case shows a pattern that edge-device defenders have seen before: VPN gateways sit at the network boundary and hold domain credentials, so a compromise there gives an attacker a trusted foothold. Volexity’s account of an attacker rerunning an in-memory exploit instead of leaving a persistent implant shows an approach that leaves little for integrity tools to find. Ivanti’s remaining unpatched privilege escalation means the window in which root access is available to an attacker who obtains code execution is still open until the promised fix ships.
