Skip to content
Hacker Posts

Ivanti Connect Secure zero-days chained for root on patched VPN

Volexity found attackers chaining three Ivanti Connect Secure zero-days (incl. CVE-2026-104935) for root on a fully patched VPN. Two are patched; the root-escalation bug is not.

Published 3 min read
cveivantivpnadvisory

Volexity says an attacker chained three Ivanti Connect Secure (ICS) zero-days to get unauthenticated, root-level code execution on a fully patched appliance. Ivanti patched two of them on October 13 as CVE-2026-104935 (an authentication bypass plus a remote code execution bug, tracked together, CVSS 8.6 per Ivanti); the third — a privilege escalation to root — is not yet patched. If you run ICS at your perimeter, treat this as an active-exploitation event today.

The primary sources are Ivanti's advisory, Security Advisory Ivanti Connect Secure (CVE-2026-104935), and Volexity's incident writeup, "A Series of Unauthenticated Events".

What's affected

  • Product: Ivanti Connect Secure (ICS).
  • The chain: an authentication bypass and an RCE bug (both covered by CVE-2026-104935) plus a separate privilege-escalation flaw that raises access to root. Only the first two are patched.
  • Patched versions (per Ivanti): 22.8R2.5, 25.1.1.2, 25.1.3.0, 25.1.3.1.
  • Unpatched third flaw: Ivanti says a fix will ship "in a future release in the coming weeks," per Volexity.

The compromised appliance Volexity investigated was running 22.8R2.4 — a build the customer believed was current. Ivanti also fixed CVSS 9.9 bugs the same day in Xtraction (CVE-2026-106042, fixed in 2026.4) and Neurons for Intune (CVE-2026-109412); Ivanti says it is not aware of exploitation of those two.

Exploitation status

Confirmed. Ivanti's October 13 post says it is aware of "limited exploitation in the wild." Volexity found the activity on one customer's appliance, dates the intrusion to October 3, and tracks the operator as UTA0576 — a previously undocumented group. Volexity assesses with low confidence that the motive is criminal rather than espionage; neither company has said how many customers were hit. Note that Ivanti's Integrity Checker Tool (ICT) does not detect this chain, per Volexity.

Volexity's report lists the following indicators from the one incident it investigated:

URL path (requested in volume):  /dana-na/auth/url_default/welcome.cgi
HTTP header anomaly:             X-DSCGI-PATH (value does not match the URL path)
On-disk artifact directory:      /data/.icscap/
Attacker IP:                     108.165.147[.]64

Action checklist

  1. Patch now to 25.1.3.1 (or the fixed build on your branch: 22.8R2.5, 25.1.1.2, 25.1.3.0). Patching closes the auth-bypass and RCE — the entry point.
  2. Do not rely on the ICT alone. It misses this chain. Hunt for the indicators above regardless of what the ICT reports.
  3. Assume compromise if you see the indicators, and remember patching does not evict an attacker who is already in. Rebuild the appliance from a clean image and rotate every credential and session the box could reach.
  4. Watch for the privilege-escalation patch. Until the third flaw ships a fix, a foothold on the box can still be escalated to root — minimize exposure (restrict management interfaces, front with access controls) in the meantime.

Context

This is the latest in a long run of perimeter-appliance zero-days where the vendor's own integrity tooling missed the intrusion — the exact failure mode we flagged when Ivanti Sentry's CVE-2026-10520 hit CISA's KEV within three days. The detail that should worry operators here is that the victim was fully patched: the chain combined a patched-class auth bypass with a bug Ivanti still hasn't fixed, so "we're current" was not a defense. Edge VPNs remain the highest-value target on the network, and the gap between "patched" and "safe" is exactly where UTA0576 operated.

Related stories