Attackers chained three Ivanti zero-days to gain root on fully patched VPN appliances
A threat actor has been using an exploit chain combining three vulnerabilities in Ivanti’s Connect Secure (ICS) appliances to breach organizations, collect credentials, exfiltrate configuration data, and perform network reconnaissance.
“In the first week of October 2026, Volexity discovered an unknown threat actor, UTA0576, abusing a zero-day exploit chain to compromise a fully patched (at the time, version 22.8R2.4) Ivanti Connect Secure (ICS) VPN appliance,” Volexity researchers shared on Tuesday.
Ivanti says that exploitation affected a limited number of customers at the time of disclosure and that it is working to help those organizations.
How the exploit chain works
According to Volexity, the exploitation chain consists of an authentication bypass (in welcome.cgi), a file write vulnerability (in wu.cgi), and a privilege escalation vulnerability “in how the ICS dsinvoked broker trusts DSCache configuration data, which enables an attacker to execute commands as root.”
This allowed the threat actor to:
- Gain unrestricted access to targeted devices
- Extract credentials stored in it
- Exfiltrate some Active Directory metadata
- Collect local admin passwords and BitLocker recovery keys
- Exfiltrate configuration data
- Capture LDAP traffic from the compromised appliance
- Modify the logs to remove evidence of malicious activity, remove temporary execution artifacts, and perform other cleanup activities.
“Volexity assesses with low confidence that UTA0576 has criminal, rather than espionage, motivations based on the target of this activity,” the company’s researchers said.
“Because the operation was detected and disrupted, the threat actor’s ultimate objectives could not be determined. However, Volexity assesses with high confidence that UTA0576’s actions signaled preparation for lateral movement and a broader compromise of the victim network.”
According to Defused Cyber, the earliest confirmed instance of this attack activity occurred on October 1.
Patches, mitigations, and detection
Ivanti has released a patch for the authentication bypass and RCE vulnerability (CVE-2026-104935), and is working on a fix for the privilege escalation portion of the exploit chain.
“Ivanti initially discovered a portion of this vulnerability as part of our product security program and patched it in the July release 25.1.3.0. We had been working to backport the fix to the remaining supported versions when exploitation occurred,” the company stated.
Ivanti advised customers to upgrade to a fixed release, check for indicators of compromise shared by Volexity, and run ICS’s Integrity Checker Tool regularly, which identify unexpected file modifications on disk.
In this particular case, however, the Integrity Checker Tool may not be of help. “Because this exploit chain patches library code in memory only and restores configuration store data, the tool does not detect any modifications. As such, forensic investigation is required to identify evidence of exploitation,” Volexity noted.
That advice was echoed by CISA, which added CVE-2026-104935 to its Known Exploited Vulnerabilities catalog and ordered US federal civilian agencies to address it and perform forensic triage by October 16, 2026.
Organizations that find evidence of compromise should follow the recovery steps outlined by Ivanti.
Subscribe to our breaking news e-mail alert to never miss out on the latest breaches, vulnerabilities and cybersecurity threats. Subscribe here!
