Ivanti Zero-Day Chain Grants Unauthenticated Root Access to Patched Gateways

Threat actor UTA0576 achieved unauthenticated root-level code execution on Ivanti Connect Secure appliances by chaining three zero-day vulnerabilities, according to Volexity. The attacker needed only network access to the gateway, requiring no user interaction or credentials. This access allowed the group to search for Active Directory secrets, including domain credentials, LAPS passwords, and BitLocker recovery keys, without installing persistent malware or web shells.

How it unfolded

• Activity began on October 3, 2026, with UTA0576 targeting a fully patched Ivanti Connect Secure version 22.8R2.4 appliance.
• The attacker used CVE-2026-104935 to bypass authentication and execute code as the cgi-server user via manipulated web requests.
• A separate privilege escalation flaw was then exploited to raise access to root, allowing command execution and log tampering.
• Ivanti released a patch for CVE-2026-104935 on October 13, while the privilege escalation fix remains under development.

Who is affected

Ivanti Connect Secure versions 22.8R2.4 and earlier, 25.1.2.2 and earlier, and 25.1.1.1 and earlier are vulnerable to CVE-2026-104935, a high-severity authentication bypass. Shadowserver tracks over 5,500 instances exposed online, though the number of honeypots is unknown. Organizations running these versions face risk from remote, unauthenticated attackers. Defused confirmed signs of exploitation in the wild starting October 1, according to its report.

The fix

Ivanti urges customers to immediately patch CVE-2026-104935 by upgrading to the fixed version. The vendor released this update on October 13. However, a fix for the privilege escalation vulnerability used in the chain is not yet available. Ivanti recommends running the Integrity Checker Tool regularly, though Volexity noted the attacker tampered with logs to evade detection.

What made it possible

Attackers often combine multiple flaws to bypass security controls that single patches address. In this scenario, an initial bypass allowed limited execution, which a subsequent privilege escalation flaw then elevated to full system control. This chaining technique renders individual patches insufficient if all vulnerabilities are not remediated simultaneously. Managed service providers should assess whether their monitoring detects transient file writes or memory-based changes, as traditional signature-based tools may miss such ephemeral activity. Teams usually verify that integrity checks cover both disk and memory states.

Background: Active Directory attacks

Disable legacy authentication protocols to block credential theft. Enforce strict least privilege to limit lateral movement. Monitor for anomalous token usage rather than relying on perimeter defenses. These steps close the gaps attackers exploit most frequently.

Read the full guide: Stop Active Directory Attacks: Priority Fixes That Actually Work

What to do and how to stay safe: Ivanti Connect Secure

• Verify that all Ivanti Connect Secure appliances are updated to the latest patched version for CVE-2026-104935 immediately.
• Monitor network traffic for unusual HTTPS requests to login scripts or public endpoints that may indicate exploitation attempts.
• Review audit logs for signs of tampering or unexpected command executions, even if integrity checks report no changes.
• Prepare to apply the pending privilege escalation fix as soon as the vendor releases it to close the full attack chain.

Step-by-step guide: Stop Log Tampering: A Defensive Checklist for Integrity

General security guidance from the RedTeam Tribune newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Which Ivanti Connect Secure versions are vulnerable to the initial bypass?

Versions 22.8R2.4 and earlier, 25.1.2.2 and earlier, and 25.1.1.1 and earlier are affected by CVE-2026-104935.

Did the attacker install malware on the compromised devices?

No, Volexity reported that UTA0576 deployed no malware or web shells, re-exploiting the device for each command.

Is there a fix for the privilege escalation vulnerability?

No, Ivanti is still working to address the privilege escalation flaw, which remains under development for a future update.