Ivanti Zero-Day Chain Gave Attackers Root Access to Fully Patched VPN

What it is

CVE-2026-104935 is a high-severity flaw in Ivanti Connect Secure (ICS) VPN appliances. It covers two bugs: an authentication bypass and a remote code execution bug. Together they let a remote, unauthenticated attacker run arbitrary commands. Ivanti says exploitation has hit a limited number of customers. Volexity found it while investigating an incident at one of its customers, and dates the earliest exploitation to October 3.

How it works

Volexity says threat actor UTA0576 chained three zero-days to get unauthenticated, root-level code execution on a fully patched ICS appliance. The CVE covers two of them. The third, a privilege escalation, has no patch yet. The page gives no further technical detail on any of the three.

Preconditions / Affected

• The target is an ICS appliance running a version before the fixed builds below.
• A patched appliance is still exposed to the privilege escalation, so patching closes only part of the chain.

What to do

• Upgrade to ICS 22.8R2.5, 25.1.1.2, 25.1.3.0 or 25.1.3.1.
• Ivanti plans to fix the privilege escalation "over the coming weeks". The page names no workaround or mitigation for it, and it publishes no indicators of compromise.
• The page lists what the attackers did after gaining access, which is useful for scoping a hunt:
• They took domain credentials stored on the appliance.
• They exfiltrated limited Active Directory metadata.
• A custom tool searched Active Directory for LAPS passwords and BitLocker recovery keys.
• They ran password spraying and tested credentials with a custom Kerberos tool.
• They tried to pull credentials from captured network traffic.
• They scanned the network and collected the appliance's configuration data.
• They parsed authentication logs to find valid usernames.
• The page doesn't spell out remediation, but it implies that any credentials the appliance held, and any LAPS or BitLocker secrets reachable from it, should be treated as exposed on a suspect device.

Caveats

• Volexity found no backdoor or web shell on the device, so a clean file check is not evidence of a clean appliance.
• The intrusion was disrupted before the attackers' goals were clear. Volexity believes with high confidence that the activity was preparation for lateral movement and wider compromise.
• Motivation is assessed with low confidence as criminal rather than espionage.
• The assessment that UTA0576 uses LLMs for exploit development and post-exploitation is medium confidence.