Ivanti Connect Secure Zero-Day Chain Exploited in the Wild
A newly uncovered zero-day exploit chain targeting Ivanti Connect Secure VPN appliances allowed a previously undocumented threat actor to achieve root-level code execution on fully patched systems.
Radwan AbdulhadiEditor and technology writer
Ivanti Connect Secure Zero-Day Chain Discovered
Ivanti recently issued warnings to customers regarding a high-severity zero-day vulnerability affecting its Connect Secure (ICS) VPN appliances. Tracked as CVE-2026-104935, the issue functions as an authentication bypass that allows remote, unauthenticated attackers to execute arbitrary commands. According to reports from SecurityWeek, Ivanti acknowledged that the vulnerability has affected a limited number of customers in active attacks.
The in-the-wild exploitation was initially uncovered by security firm Volexity while investigating an incident affecting one of its customers. Further details of the campaign are outlined on the Volexity blog, which explains how a previously undocumented threat actor tracked as UTA0576 managed to bypass security mechanisms on a fully patched ICS appliance.
Anatomy of the Exploit Chain and UTA0576 Activity
Investigations by Volexity revealed that the threat actor UTA0576 chained three zero-day vulnerabilities together to gain unauthenticated, root-level code execution on an ICS appliance that had been fully patched. Among these flaws, CVE-2026-104935 encompasses two distinct components: an authentication bypass and a remote code execution bug. Evidence gathered by researchers indicated that the malicious activity began as early as October 3.
Once inside the compromised network environment, UTA0576 shifted its focus heavily toward credential theft, data exfiltration, network reconnaissance, and log tampering. The attackers stole domain credentials stored directly on the appliance and exfiltrated limited Active Directory metadata. Using custom tools, they systematically searched Active Directory for LAPS passwords and BitLocker recovery keys, conducted password-spraying operations, tested credentials using a custom Kerberos tool, and attempted to extract sensitive data from captured network traffic.
Network Reconnaissance and Disruption of Operations
In addition to harvesting credentials, the threat actors performed broad network scans, gathered configuration data from the appliance, and parsed authentication logs to identify valid usernames. Notably, Volexity did not find any persistent backdoors or web shells left behind on the targeted device. The malicious operation was successfully detected and disrupted before the attackers could execute their ultimate strategic goals.
Despite the intervention halting the operation, security analysts hold high confidence that the behavior strongly indicated preparations for lateral movement and a broader network compromise. Analysts also noted that the targeting patterns point toward potential criminal motivations rather than traditional espionage.
Vendor Patching Status and Ongoing Remediation
In response to the discovered vulnerabilities, Ivanti moved to release software updates addressing the primary flaws. The vendor rolled out ICS versions 22.8R2.5, 25.1.1.2, 25.1.3.0, and 25.1.3.1 to patch both the authentication bypass and the remote code execution component covered under the main advisory.
However, the third vulnerability utilized in the attack chain—a privilege escalation issue—remains unpatched at this time. Ivanti has stated that it plans to release a fix for this remaining component in the coming weeks, advising administrators to apply the currently available updates immediately.
Sources
- SecurityWeekIvanti Zero-Day Chain Gave Attackers Root Access to Fully Patched VPN
Continue chronologically
Related stories
Ivanti Patches Two Zero-Days in Connect Secure Attack Chain
Ivanti has issued security updates for two additional Connect Secure zero-days that attackers chained with a previously disclosed VPN vulnerability.
Ivanti Patches Two More Connect Secure Zero-Days
Ivanti releases security updates for two additional Connect Secure gateway flaws chained in zero-day attacks since October, following a prior bug fix.
CISA Warns Admins to Immediately Fix Ivanti Flaw
CISA urges security teams to immediately patch a high-severity Ivanti Connect Secure zero-day flaw actively exploited in recent cyber attacks.
Citrix, Fortinet, and Ivanti Patch 29 Security Vulnerabilities
Citrix, Fortinet, and Ivanti release vital security updates addressing 29 vulnerabilities, including critical execution and zero-day flaws.
