Ivanti VPN Zero-Day Chain Gives Root Access; One Flaw Unpatched

Attackers chained three zero-day flaws to gain root control of fully patched Ivanti Connect Secure VPN appliances, and one of those flaws still has no fix. The chain let an outsider run commands as root without logging in, according to iTnews. For US companies and federal agencies that expose these gateways to the internet, the Ivanti Connect Secure zero-day is a live problem that patching cannot fully close yet.

Ivanti warned customers on Tuesday, October 13, that a zero-day in Connect Secure was being exploited. The company said it knew of exploitation affecting a limited number of customers, as SecurityWeek reported. Volexity found the activity while investigating an incident at one of its own customers, and it tracks the actor as UTA0576, a previously undocumented group.

The phrase "fully patched" carries the story. Volexity's research team described the target as a "fully patched device," in a statement that Cybernews quoted. That means the appliance was current on Ivanti's releases and still gave the attacker a way in.

How the three-flaw chain gave attackers root

The attackers went after an appliance running version 22.8R2.4, which was the newest release when the attacks began. CyberPress reports that some outlets rate CVE-2026-104935 at CVSS 8.6.

Ivanti fixed the first two flaws on October 13, an authentication bypass and a remote code execution bug, under CVE-2026-104935. The third flaw is a privilege escalation bug. Volexity told iTnews that a fix is weeks away, which leaves customers with a known gap and no date.

The order of the chain explains why the open flaw matters. An authentication bypass lets an outsider reach functions that should require a login, and code execution lets that outsider run commands. A privilege escalation flaw is the step that turns those commands into root. Patching two links does not break the chain while the remaining link is the one that grants root, so the open flaw deserves the most attention until Ivanti ships a fix.

This chain is separate from the Ivanti issues USA 24 has already covered, and it stands on its own as a root-access risk for any organization that runs Connect Secure at its edge.

Timeline of the Ivanti Connect Secure zero-day

The key dates, as the sources describe them, are below.

What the attacker stole and how it stayed hidden

Once inside, the attacker stole domain credentials stored on the appliance and pulled limited Active Directory metadata, according to Cybersecurity News. It also searched for LAPS local administrator passwords and targeted BitLocker recovery keys. Those targets show the goal. The VPN appliance was the entry point, and the Active Directory environment behind it was the objective, as Etairos summarized Volexity's findings.

The attacker left no malware or web shell on the device. It reran the full chain for each command, patched library code only in memory, and edited logs to hide its activity, according to iTnews, Cybernews and Etairos. That approach weakens the usual check of looking for a suspicious file. A clean file system does not prove a clean device, which is why the hunt has to focus on traffic, memory and logs.

How to check Ivanti Connect Secure for compromise

Start with the patch, then hunt for signs of intrusion.

1. Confirm your appliance version and apply Ivanti's fix for CVE-2026-104935. That closes two of the three flaws.
2. Do not treat a clean result from Ivanti's Integrity Checker Tool as proof. Volexity says the chain evades that tool, according to iTnews and YAAM Labs.
3. Search for indicators. Researchers flagged suspicious requests to the welcome.cgi path and an unusual X-DSCGI-PATH header. Volexity says confirming a breach takes forensic work, including network and memory analysis.
4. Reset the Active Directory service and domain credentials the appliance used. Rotate LAPS-managed local administrator passwords. Review whether BitLocker recovery keys may have been exposed. These three steps are our recommendations, not steps the sources prescribe, and they follow directly from what the attacker went after.
5. Limit who can reach the appliance's administrative interfaces while the third flaw stays open. This is also our recommendation.

What the CISA deadline means for federal networks

iTnews reports that CISA added the flaw to its Known Exploited Vulnerabilities catalog and ordered federal agencies to patch by October 16. That date has passed. Agencies that have applied the October 13 fix still have an open flaw on the device, and the deadline offers no relief for that gap.

Readers should verify the catalog entry on CISA's website before relying on it. The alert CISA published on October 16 lists other vulnerabilities and does not show this Ivanti flaw.

Ivanti VPNs are common in US enterprises and federal networks, so organizations that run Connect Secure with access to Active Directory face the most risk. Ivanti has not published a count of affected customers, and the sources do not name any victims.

What comes next for UTA0576 and the open flaw

Watch three things. First, the fix for the third flaw, which Volexity says is weeks away. Second, whether Ivanti or others publish a count of affected customers, since Ivanti says only a limited number were hit. Third, whether UTA0576 gets firmer attribution, because the sources do not identify the actor's nationality or motive.

Remote access products have been a repeat target. USA 24 recently covered a BeyondTrust zero-day whose headline advice was to patch now and then rebuild. Stolen logins are a common thread as well, as in the ConnectWise credential case that opened 173 Microsoft 365 tenants.

For defenders, the next few weeks matter most. Until the third flaw gets a fix, the safe assumption is that a Connect Secure appliance with Active Directory access is a high-value target and should be managed that way.