Ivanti Connect Secure zero-day chain gives root access
Ivanti Connect Secure zero-days have been used in an attack chain that let an unauthenticated attacker run commands as root, the highest level of control on the VPN appliance, according to security firm Volexity. Ivanti said on October 13 that it was aware of limited exploitation in the wild and told customers on affected versions to act immediately. Two of the flaws have fixes available, while Volexity said a fix for the third issue is still due in a future release in the coming weeks.
Volexity said it reported the flaws to Ivanti after investigating one customer appliance. That system was fully patched at the time of the attack and was running Connect Secure version 22.8R2.4. The activity began on October 3 and is tracked by Volexity as UTA0576. Ivanti Connect Secure is a VPN appliance, meaning it provides remote access into an organisation network, so compromise can matter well beyond the device itself.
The first two flaws are grouped under CVE-2026-104935. Ivanti describes them as an authentication bypass and a remote code execution issue. In plain terms, the authentication bypass lets an attacker get past the normal login requirement, while remote code execution lets them make the appliance run commands. Volexity said those two flaws together allow code to run as the appliance cgi-server user. A third flaw then escalates that access to root, giving the attacker the most powerful level of control on the appliance.
The CVE record filed by Ivanti says Connect Secure before version 25.1.3.0 is affected. It lists version 22.7R2.14 or prior as not affected, and also lists versions 22.8R2.5, 25.1.3.0 and 25.1.3.1 as unaffected. The release notes for 25.1.3.0 are dated July 2026, so customers already on that release are outside the affected range described in the CVE record. Ivanti rates CVE-2026-104935 at 8.6 out of 10 on the CVSS severity scale, which is a scoring system used to compare vulnerability severity.
The U.S. Cybersecurity and Infrastructure Security Agency, in its entry in the CVE record, marks exploitation as active and the technical impact as total. That aligns with the core risk described by Volexity: an attacker did not need to log in before chaining the flaws, and the chain ended with root-level command execution. Volexity’s report does not say what risk the still-unfixed privilege escalation flaw carries on an appliance where the first two flaws have already been fixed.
Ivanti advises customers to upgrade and to run its Integrity Checker Tool regularly. Volexity said, however, that the tool did not detect this specific chain because the exploit altered library code only in memory and restored the configuration data it changed. Volexity also said the attacker took steps intended to avoid detection by the tool. As a result, Volexity said confirming compromise requires forensic investigation, including network and memory forensics.
The signs Volexity reported come from the single incident it investigated. They include unusually large numbers of requests to the URL path /dana-na/auth/url_default/welcome.cgi, and those requests containing the HTTP header X-DSCGI-PATH with a value that did not match the URL path. Volexity also named the directory /data/.icscap/ and the IP address 108.165.147[.]64 as indicators from that incident. These details should be treated as incident indicators, not as proof that other attacks would look identical.
In the investigated case, Volexity said the attacker stole stored credentials, including LDAP domain credentials. LDAP, or Lightweight Directory Access Protocol, is commonly used to look up users and permissions in an organisation directory. Volexity also said the attacker searched Active Directory for passwords and carried out password-spraying attacks against accounts. Password spraying is when an attacker tries common passwords across many accounts instead of repeatedly attacking just one account. Volexity said no backdoor or web shell was left behind, and the attacker reran the full exploit chain for each command.
For website owners and IT teams, the practical concern is that a VPN appliance often sits at a trusted entry point into internal systems. If it is compromised, the attacker may be able to reach credentials and directory services that support websites, hosting control panels, back-office applications and cloud administration. The reports from Ivanti and Volexity do not name a temporary workaround for customers who cannot upgrade yet. They also do not state whether upgrading removes access that an attacker may already have gained.
Volexity assessed with low confidence that UTA0576’s motive is criminal rather than espionage. Neither Ivanti nor Volexity said how many customers were attacked. That leaves the public record with clear evidence of limited exploitation and a documented incident, but without a confirmed victim count.
The same Ivanti post also covers fixes for Xtraction and Neurons Patch for Intune. Ivanti said it is not aware of those flaws being exploited. The issues include CVE-2026-106042 in Xtraction before version 2026.4 and CVE-2026-109412 in Neurons Patch for Intune, each rated by Ivanti at 9.9 out of 10.
Organisations reviewing exposure from VPN and infrastructure incidents can use AEU-I for security-first IT, infrastructure and consulting, which is directly relevant when remote-access systems are part of the environment. For now, affected Connect Secure customers should prioritise the upgrade guidance, preserve evidence if compromise is suspected, and avoid assuming that a clean integrity check alone rules out this attack chain.