Ivanti Connect Secure Zero-Day Chain Gave Attackers Root Access to Fully Patched VPNs

Attacker Chained Three Ivanti Connect Secure Zero-Days to Get Unauthenticated Root Access

Security firm Volexity disclosed on October 13, 2026 that an unknown threat actor it tracks as UTA0576 chained together three zero-day vulnerabilities in Ivanti Connect Secure (ICS) VPN appliances to achieve unauthenticated, root-level code execution — on devices that were otherwise fully patched at the time of compromise. Two of the three flaws are tracked together as CVE-2026-104935 (CVSS 8.6) and were fixed on October 13, 2026; the third, a privilege-escalation bug, remains unpatched while Ivanti works on a fix for a future release. CISA has added CVE-2026-104935 to its Known Exploited Vulnerabilities catalog, giving federal agencies a three-day patch window.

Incident Details

How the Exploit Chain Works

Volexity's analysis describes a three-stage chain combining an authentication bypass, a remote code execution bug, and a privilege escalation flaw:

1. Authentication bypass in welcome.cgi — lets the attacker reach CGI scripts that should require a logged-in session.
2. File-write vulnerability in wu.cgi — the upload handler, which the attacker abuses to write a malicious file to the appliance. Together with the bypass, these two flaws are tracked as CVE-2026-104935.
3. Privilege escalation via a shared in-memory configuration store — the attacker tampers with configuration data held in memory, tricking a root-level maintenance service into executing attacker-controlled code. The exploit then restores the configuration store to its original state, erasing the evidence that it was ever touched.

Because the privilege-escalation step operates entirely in memory and reverses its own changes, it slips past Ivanti's Integrity Checker Tool, which is designed to detect unauthorized file-level modifications on disk — not transient, self-cleaning memory tampering.

Operational Security: No Malware Needed

What makes UTA0576 notable is what it didn't leave behind. Rather than dropping a web shell or backdoor that could be found by a file-system scan, the actor re-ran the entire three-stage exploit chain for every single command it wanted to execute on the appliance. Each run also tampered with Ivanti debug logs and Linux audit logs to remove traces of the activity. Volexity ultimately had to rely on forensic memory and disk imaging — working with Ivanti to capture core dumps generated during exploitation — to reconstruct how the compromise happened at all.

Once inside, the actor's objective was clearly credential harvesting: it stole stored credentials including LDAP domain credentials, searched Active Directory for additional passwords, and ran password-spraying attacks against discovered accounts. Volexity also observed network scanning and collection of the appliance's own configuration and authentication logs — likely to identify valid usernames for further spraying.

Patch Status and Open Risk

Ivanti shipped a fix for the authentication-bypass-and-RCE pair (CVE-2026-104935) on October 13, 2026, but the privilege-escalation flaw that enables root access is still unpatched — Ivanti says a fix is coming in a future release. Neither Ivanti's advisory nor Volexity's report specifies a temporary workaround for organizations that can't upgrade immediately, and neither source confirms whether patching removes access an attacker may have already established. CVE-2026-104935 is now the 15th Ivanti Connect Secure/Pulse Connect Secure vulnerability added to the CISA KEV catalog — a track record that makes clear ICS appliances remain a high-value target for zero-day development.

Recommendations

For Ivanti Connect Secure Administrators

• Patch immediately against CVE-2026-104935; the window CISA set for federal agencies (three days) is a reasonable urgency bar for any organization running ICS.
• Because the privilege-escalation flaw is still unpatched, assume a sufficiently motivated attacker can still reach root on an unpatched appliance even post-update for the other two bugs — isolate ICS management interfaces and monitor closely.
• Do not rely solely on the Integrity Checker Tool to rule out compromise — this exploit chain was specifically designed to evade it. Pursue memory and disk forensics if compromise is suspected.

For Security Teams

• Hunt for suspicious requests to welcome.cgi, one of the indicators of compromise Volexity published, in ICS access logs.
• Given the attacker's focus on LDAP credential theft and password spraying, review Active Directory authentication logs for spray patterns originating from or near the VPN appliance's network segment, and consider forcing a credential reset for accounts with LDAP binds exposed through ICS.
• Treat any ICS appliance that was internet-facing during the October 1–13, 2026 window as a candidate for forensic review, not just a patch-and-move-on asset — the lack of a web shell means a simple file scan will not rule out compromise.

Key Takeaways

1. Threat actor UTA0576 chained three Ivanti Connect Secure zero-days — an auth bypass, an RCE, and a privilege escalation — to get unauthenticated root access on fully patched appliances.
2. Two of the three flaws are tracked as CVE-2026-104935 (CVSS 8.6) and were patched October 13, 2026; the privilege-escalation flaw remains unpatched.
3. The attacker left no malware or web shell, instead re-exploiting the full chain for every command and tampering with logs to evade Ivanti's Integrity Checker Tool.
4. Post-compromise activity focused on credential theft — LDAP credentials, Active Directory password spraying, and authentication log collection.
5. CISA added the flaw to its KEV catalog with a three-day federal patch deadline; this is the 15th ICS/Pulse Connect Secure CVE on that list.

Sources

• A Series of Unauthenticated Events: Chained Exploitation of Ivanti Connect Secure Zero-Days — Volexity
• Ivanti Zero-Day Chain Gave Attackers Root Access to Fully Patched VPN — SecurityWeek
• Attacker Chains Three Ivanti Connect Secure Zero-Days for Root Access, Only Two Patched So Far — The Hacker News
• Ivanti Connect Secure Zero-Day Chain CVE-2026-104935 Exploited by UTA0576 to Gain Root Access — SecurityOnline