A fully patched VPN, and root in three steps
Volexity says an unknown actor chained three flaws in Ivanti Connect Secure from 3 October to run commands as root on an appliance that was fully patched at the time. Ivanti has fixed two of them under one CVE; the third is still open.
Ildefonso Polo via UnsplashSecurity firm Volexity said on Tuesday that a previously unknown threat actor had chained three vulnerabilities in Ivanti Connect Secure VPN appliances to run code as root without logging in, according to its published analysis. It tracks the actor as UTA0576. Volexity said exploitation began on 3 October and that it began investigating suspicious activity at a network-monitoring customer on 5 October. The compromised appliance ran version 22.8R2.4, Build 19097, which Volexity described as fully patched at the time.
Ivanti's security advisory, published the same day, covers one high-severity vulnerability, CVE-2026-104935, an authentication bypass by spoofing rated 8.6 on the CVSS scale. "We are aware of exploitation in the wild affecting a limited number of customers at the time of disclosure," the company said. CISA added the flaw to its Known Exploited Vulnerabilities catalogue on Tuesday, alongside a Windows command-injection bug, CVE-2026-96951.
The count differs because one identifier covers two flaws. Volexity describes three: an authentication bypass in a public login script, welcome.cgi, which routes requests to protected scripts named in a request header; a file-write bug in an upload handler, wu.cgi, which writes an uploaded file to disk before checking it and lets an attacker run it in that window; and a privilege escalation in a root-level broker service that trusts a shared configuration store. Volexity says Ivanti tracks the first two under CVE-2026-104935. The third has no CVE and no fix yet; Volexity says Ivanti is working on one for "a future release in the coming weeks".
Ivanti lists the affected builds as 25.1.1.1 and earlier, 25.1.2.2 and earlier, and 22.8R2.4 and earlier. The fixed builds are 25.1.1.2, which the advisory says was released on 5 October, and 22.8R2.5, released on 12 October; 25.1.3.0 and 25.1.3.1, which run on Ivanti's newer appliance platform, are listed as resolved, and versions 22.7R2.14 and earlier are not affected. Ivanti said it had found "a portion of this vulnerability" itself and fixed it in the July release, 25.1.3.0, and had been working to backport that fix to other supported versions "when exploitation occurred". Ten days passed between the first exploitation Volexity saw and the advisory, by our count.
Once on the appliance, Volexity said, the attacker extracted stored domain credentials, used the appliance's Active Directory service account to search for LAPS administrator passwords and BitLocker recovery keys, deployed custom Kerberos and LDAP tools, sprayed passwords against Active Directory accounts and tried to pull credentials from captured LDAP traffic. It deleted entries from Ivanti's debug log and the Linux audit log. Volexity found no first-stage malware or web shell: each command ran by exploiting the device again, with results returned in the HTTP response.
Volexity assessed with low confidence that the motive is criminal rather than espionage, based on the target, and with medium confidence that the actor used large language models to write exploits and run post-exploitation work. Because the intrusion was detected and disrupted, it said, the actor's ultimate objective could not be determined.
Detection is the harder problem. Ivanti's advisory says indicators are limited, points customers to Volexity's post and advises running its Integrity Checker Tool regularly. Volexity says the chain patches library code in memory only and restores the configuration it changes, so that tool "does not detect any modifications", and it warned that "The Ivanti Integrity Checker may not be able to identify device compromise." It recommends applying the patches, watching for high volumes of requests to welcome.cgi in which the URL and the X-DSCGI-PATH header do not match, checking the /tmp/ directory and doing network and memory forensics on suspect devices.
This is the third year in a row that attackers have exploited undisclosed flaws in Connect Secure, after January 2024 and January 2025, and edge devices keep producing them. Komposite reported on Monday on a third NetScaler patch in eleven days, and earlier on a breach that came through a known VPN flaw. Volexity's account rests on one customer's appliance; Ivanti has not said how many customers were affected beyond "a limited number".