# Ivanti VPN Zero-Day Chain Gives Root Access; One Flaw Unpatched

- URL: https://usa-24.com/ivanti-connect-secure-zero-day-root-access/
- Publisher: USA 24
- Section: Cybersecurity
- Published: 2026-10-18T05:37:37.286Z
- Updated: 2026-10-18T05:37:37.294Z
- Topics: Zero-Day Vulnerabilities, VPN Security, Ivanti, Active Directory, Patch Management

> A threat actor chained three zero-days to gain root on fully patched Ivanti Connect Secure VPNs, and one flaw still has no fix. Here is what defenders should do now.

## Key takeaways

- Attackers chained three zero-days to run commands as root on fully patched Ivanti Connect Secure VPN appliances without logging in.
- Ivanti fixed two of the three flaws on October 13, 2026, under CVE-2026-104935, while the third privilege escalation flaw remains unpatched.
- Volexity says exploitation began on October 3, and the federal patch deadline CISA set for October 16 has already passed.
- The attacker went after domain credentials, LAPS local admin passwords and BitLocker recovery keys, and left no malware or web shell on the device.
- Volexity says the chain evades Ivanti's Integrity Checker Tool, so defenders need forensic hunting to confirm a breach.

Attackers chained three zero-day flaws to gain root control of fully patched Ivanti Connect Secure VPN appliances, and one of those flaws still has no fix. The chain let an outsider run commands as root without logging in, according to [iTnews](https://www.itnews.com.au/news/attackers-chain-three-ivanti-vpn-zero-days-for-root-access-629621). For US companies and federal agencies that expose these gateways to the internet, the Ivanti Connect Secure zero-day is a live problem that patching cannot fully close yet.

Ivanti warned customers on Tuesday, October 13, that a zero-day in Connect Secure was being exploited. The company said it knew of exploitation affecting a limited number of customers, as [SecurityWeek](https://www.securityweek.com/ivanti-zero-day-chain-gave-attackers-root-access-to-fully-patched-vpn/) reported. Volexity found the activity while investigating an incident at one of its own customers, and it tracks the actor as UTA0576, a previously undocumented group.

The phrase "fully patched" carries the story. Volexity's research team described the target as a "fully patched device," in a statement that [Cybernews](https://cybernews.com/security/ivanti-zero-day-july-cisa-patch-no-fix/) quoted. That means the appliance was current on Ivanti's releases and still gave the attacker a way in.

## How the three-flaw chain gave attackers root

The attackers went after an appliance running version 22.8R2.4, which was the newest release when the attacks began. [CyberPress](https://cyberpress.org/ivanti-vpn-zero-day-exploitation/) reports that some outlets rate CVE-2026-104935 at CVSS 8.6.

Ivanti fixed the first two flaws on October 13, an authentication bypass and a remote code execution bug, under CVE-2026-104935. The third flaw is a privilege escalation bug. Volexity told iTnews that a fix is weeks away, which leaves customers with a known gap and no date.

The order of the chain explains why the open flaw matters. An authentication bypass lets an outsider reach functions that should require a login, and code execution lets that outsider run commands. A privilege escalation flaw is the step that turns those commands into root. Patching two links does not break the chain while the remaining link is the one that grants root, so the open flaw deserves the most attention until Ivanti ships a fix.

This chain is separate from the Ivanti issues USA 24 has already covered, and it stands on its own as a root-access risk for any organization that runs Connect Secure at its edge.

## Timeline of the Ivanti Connect Secure zero-day

The key dates, as the sources describe them, are below.

| Date | What happened |
|---|---|
| October 3, 2026 | Exploitation begins, according to Volexity |
| October 13, 2026 | Ivanti discloses the zero-day and ships fixes for two flaws under CVE-2026-104935 |
| October 16, 2026 | CISA's federal patch deadline passes |
| No date yet | Fix for the third privilege escalation flaw, which Volexity says is weeks away |

## What the attacker stole and how it stayed hidden

Once inside, the attacker stole domain credentials stored on the appliance and pulled limited Active Directory metadata, according to [Cybersecurity News](https://cybersecuritynews.com/ivanti-connect-secure/). It also searched for LAPS local administrator passwords and targeted BitLocker recovery keys. Those targets show the goal. The VPN appliance was the entry point, and the Active Directory environment behind it was the objective, as [Etairos](https://dev.to/etairos/three-ivanti-connect-secure-zero-days-chained-for-unauthenticated-root-one-still-unpatched-44eg) summarized Volexity's findings.

The attacker left no malware or web shell on the device. It reran the full chain for each command, patched library code only in memory, and edited logs to hide its activity, according to [iTnews](https://www.itnews.com.au/news/attackers-chain-three-ivanti-vpn-zero-days-for-root-access-629621), [Cybernews](https://cybernews.com/security/ivanti-zero-day-july-cisa-patch-no-fix/) and [Etairos](https://dev.to/etairos/three-ivanti-connect-secure-zero-days-chained-for-unauthenticated-root-one-still-unpatched-44eg). That approach weakens the usual check of looking for a suspicious file. A clean file system does not prove a clean device, which is why the hunt has to focus on traffic, memory and logs.

## How to check Ivanti Connect Secure for compromise

Start with the patch, then hunt for signs of intrusion.

1. Confirm your appliance version and apply Ivanti's fix for CVE-2026-104935. That closes two of the three flaws.
2. Do not treat a clean result from Ivanti's Integrity Checker Tool as proof. Volexity says the chain evades that tool, according to [iTnews](https://www.itnews.com.au/news/attackers-chain-three-ivanti-vpn-zero-days-for-root-access-629621) and [YAAM Labs](https://yaamlabs.com/blog/ivanti-connect-secure-cve-2026-104935).
3. Search for indicators. Researchers flagged suspicious requests to the welcome.cgi path and an unusual X-DSCGI-PATH header. Volexity says confirming a breach takes forensic work, including network and memory analysis.
4. Reset the Active Directory service and domain credentials the appliance used. Rotate LAPS-managed local administrator passwords. Review whether BitLocker recovery keys may have been exposed. These three steps are our recommendations, not steps the sources prescribe, and they follow directly from what the attacker went after.
5. Limit who can reach the appliance's administrative interfaces while the third flaw stays open. This is also our recommendation.

## What the CISA deadline means for federal networks

iTnews reports that CISA added the flaw to its Known Exploited Vulnerabilities catalog and ordered federal agencies to patch by October 16. That date has passed. Agencies that have applied the October 13 fix still have an open flaw on the device, and the deadline offers no relief for that gap.

Readers should verify the catalog entry on CISA's website before relying on it. The alert CISA published on October 16 lists other vulnerabilities and does not show this Ivanti flaw.

Ivanti VPNs are common in US enterprises and federal networks, so organizations that run Connect Secure with access to Active Directory face the most risk. Ivanti has not published a count of affected customers, and the sources do not name any victims.

## What comes next for UTA0576 and the open flaw

Watch three things. First, the fix for the third flaw, which Volexity says is weeks away. Second, whether Ivanti or others publish a count of affected customers, since Ivanti says only a limited number were hit. Third, whether UTA0576 gets firmer attribution, because the sources do not identify the actor's nationality or motive.

Remote access products have been a repeat target. USA 24 recently covered a [BeyondTrust zero-day](https://usa-24.com/beyondtrust-remote-support-zero-day/) whose headline advice was to patch now and then rebuild. Stolen logins are a common thread as well, as in the [ConnectWise credential case](https://usa-24.com/connectwise-cloud-backup-breach/) that opened 173 Microsoft 365 tenants.

For defenders, the next few weeks matter most. Until the third flaw gets a fix, the safe assumption is that a Connect Secure appliance with Active Directory access is a high-value target and should be managed that way.

## Frequently asked questions

### Is the Ivanti Connect Secure zero-day fully patched?

Only partly. Ivanti fixed two of the three flaws in the chain on October 13, 2026, under CVE-2026-104935. The third privilege escalation flaw has no fix yet, and Volexity told iTnews that one is weeks away.

### Which Ivanti Connect Secure version is affected?

The attackers targeted an appliance running version 22.8R2.4, which was the newest release when the attacks began. Customers should confirm their appliance version and apply Ivanti's fix for CVE-2026-104935.

### Who is UTA0576?

UTA0576 is the label Volexity uses for a previously undocumented threat actor behind this chain. The sources do not identify the group's nationality or motive, and attribution remains unresolved.

### How can I check whether my Ivanti VPN was compromised?

Do not rely on Ivanti's Integrity Checker Tool, because Volexity says the chain evades it. Look for suspicious requests to welcome.cgi and an unusual X-DSCGI-PATH header, and expect confirmation to require network and memory analysis.

### Did CISA require federal agencies to patch this flaw?

iTnews reports that CISA ordered federal agencies to patch by October 16, 2026, a deadline that has already passed. Verify the catalog entry directly on CISA's website, because its October 16 alert does not list this Ivanti bug.

## Sources

1. [Ivanti Zero-Day Chain Gave Attackers Root Access to Fully Patched VPN — SecurityWeek](https://www.securityweek.com/ivanti-zero-day-chain-gave-attackers-root-access-to-fully-patched-vpn/)
2. [Ivanti Connect Secure 0-Days Exploited to Steal Active Directory Credentials — Cybersecurity News](https://cybersecuritynews.com/ivanti-connect-secure/)
3. [Attackers chain three Ivanti VPN zero-days for root access — iTnews](https://www.itnews.com.au/news/attackers-chain-three-ivanti-vpn-zero-days-for-root-access-629621)
4. [Three Ivanti Connect Secure zero-days exploited in the wild — Cybernews](https://cybernews.com/security/ivanti-zero-day-july-cisa-patch-no-fix/)
5. [Ivanti VPN Zero-Day Attack Bypasses Authentication and Gains Root Privileges — CyberPress](https://cyberpress.org/ivanti-vpn-zero-day-exploitation/)
6. [Ivanti Connect Secure zero-day chain: patch, then hunt — YAAM Labs](https://yaamlabs.com/blog/ivanti-connect-secure-cve-2026-104935)
7. [Three Ivanti Connect Secure Zero-Days Chained for Unauthenticated Root, One Still Unpatched — Etairos (DEV Community)](https://dev.to/etairos/three-ivanti-connect-secure-zero-days-chained-for-unauthenticated-root-one-still-unpatched-44eg)