Ivanti Zero-Day Chain Gave Attackers Root Access to Fully …

Vulnerabilities

Ivanti Zero-Day Chain Gave Attackers Root Access to Fully Patched VPN

CVE-2026-104935 affects Ivanti Connect Secure and it can be exploited for unauthenticated remote code execution with elevated privileges.

Ivanti Zero-Day Chain Gave Attackers Root Access to Fully Patched VPN illustration

Eduard Kovacs

October 13, 2026 (2:43 PM ET)

+ Flipboard + Reddit [+ Whatsapp](https://web.whatsapp.com/send?text=Ivanti Zero-Day Chain Gave Attackers Root Access to Fully Patched VPN https://www.securityweek.com/ivanti-zero-day-chain-gave-attackers-root-access-to-fully-patched-vpn/) [+ Whatsapp](whatsapp://send?text=Ivanti Zero-Day Chain Gave Attackers Root Access to Fully Patched VPN https://www.securityweek.com/ivanti-zero-day-chain-gave-attackers-root-access-to-fully-patched-vpn/) + Email

Ivanti vulnerability exploited

Ivanti on Tuesday warned customers that a zero-day vulnerability in its Connect Secure (ICS) VPN appliances has been exploited in the wild.

Tracked as CVE-2026-104935 and rated high severity, the issue is an authentication bypass that lets a remote, unauthenticated attacker execute arbitrary commands. Ivanti says it’s aware of exploitation affecting a limited number of customers.

Volexity discovered the in-the-wild exploitation while investigating an incident at one of its customers. A previously undocumented threat actor it tracks as UTA0576 had chained three zero-days to gain unauthenticated, root-level code execution on a fully patched ICS appliance.

According to Volexity, CVE-2026-104935 covers two of the flaws: an authentication bypass and a remote code execution bug. Ivanti has patched these vulnerabilities with the release of ICS versions 22.8R2.5, 25.1.1.2, 25.1.3.0, and 25.1.3.1.

The third vulnerability, a privilege escalation issue, remains unpatched, and the vendor plans to fix it over the coming weeks.

Volexity, which found evidence of exploitation starting on October 3, says UTA0576 focused primarily on credential theft, data exfiltration, network reconnaissance, and log tampering.

Advertisement. Scroll to continue reading.

The attackers stole domain credentials stored on the appliance and exfiltrated limited Active Directory metadata. Using a custom tool, they searched Active Directory for LAPS passwords and BitLocker recovery keys.

They also ran password-spraying attacks, tested credentials with a custom Kerberos tool, and tried to extract credentials from captured network traffic. They also scanned the network, collected the appliance’s configuration data, and parsed authentication logs to identify valid usernames. Volexity found no backdoor or web shell on the device.

The operation was detected and disrupted before the attackers’ ultimate goals became clear. Volexity believes with high confidence that their actions pointed to preparation for lateral movement and a wider compromise of the network.

“Volexity assesses with low confidence that UTA0576 has criminal, rather than espionage, motivations based on the target of this activity,” the company says .

“As with many other threat actor operations Volexity has investigated in 2026, Volexity assesses with medium confidence that UTA0576 makes use of large language models (LLMs) for exploit development and post-exploitation activity,” it added.

Ivanti Zero-Day Chain Gave Attackers Root Access to Fully Patched VPN illustration

Written By

Eduard Kovacs

Eduard Kovacs (@EduardKovacs) is senior managing editor at SecurityWeek. He worked as a high school IT teacher before starting a career in journalism in 2011. Eduard holds a bachelor’s degree in industrial informatics and a master’s degree in computer techniques applied in electrical engineering.

Subscribe to the SecurityWeek Email Briefing for the latest cybersecurity threats, trends, and expert insights.

Latest News

Ivanti Zero-Day Chain Gave Attackers Root Access to Fully Patched VPN illustration

iRhythm Data Breach Impacts at Least 360,000 People

Meta Says Hackers Took Code, Personal Data of 1,500 in GitHub Breach

Cyberattack Prompts Grocery Giant Ahold Delhaize to Disconnect Systems

Small AI Models Could Soon Self-Replicate on IoT Devices, Anthropic Warns

US Seeks Alleged Chinese Hafnium Hacker With $10 Million Reward

Microsoft Patches Record 1,413 Vulnerabilities, Including Exploited Windows Zero-Day

Adobe Patches 176 Vulnerabilities Across 11 Products

Ransomware Response Expert Arrested in ShinyHunters FBI Hack Probe

Subscribe to the SecurityWeek Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts.

## Webinar: The AI Access Risk Already in Your Google Workspace

October 19, 2026

AI tools connected to Google Workspace can access millions of sensitive emails and files. Join this session to uncover your organization’s risk and learn a framework to manage AI access.

## Virtual Event: Zero Trust & Identity Strategies Summit 2026

October 14, 2026

Join as we decipher the world of zero trust and share war stories on securing an organization by eliminating implicit trust and continuously validating every stage of a digital interaction.

People on the Move

Adam Zolle has joined Nike as CISO.

Jeff Hackett has been appointed CFO at internet intelligence provider Censys.

Accenture Federal Services has named Nathaniel Parker as CISO.

More People On The Move

Expert Insights

## AI Has Changed Attack Speed, Not Security Fundamentals

Ivanti Zero-Day Chain Gave Attackers Root Access to Fully Patched VPN illustration

As AI accelerates vulnerability discovery and exploitation, so-called virtual patching still comes down to defense-in-depth and strong application security fundamentals. (Joshua Goldfarb)

## Four Cyber Threats Harboring Big Plans for the Future

Ivanti Zero-Day Chain Gave Attackers Root Access to Fully Patched VPN illustration

AI, supply-chain exposure, quantum computing and geopolitical conflict are testing security programs. Preparing for disruption must become part of day-to-day operations. (Steve Durbin)

## Begin at the End: How to Enable Agentic Remediation

Ivanti Zero-Day Chain Gave Attackers Root Access to Fully Patched VPN illustration

Agentic remediation is not an act of faith. We are talking about fixing known problems, not judgment calls about unfamiliar risk. (Nadir Izrael)

## “We Think the Security Control Is Working” Is No Longer Good Enough

Ivanti Zero-Day Chain Gave Attackers Root Access to Fully Patched VPN illustration

Point-in-time audits and sampled assessments offer only snapshots; continuous control monitoring provides evidence that security controls are working today. (Sravish Sridhar)

## This Key Will Self-Destruct: An Open Standard for Revocable API Keys

Ivanti Zero-Day Chain Gave Attackers Root Access to Fully Patched VPN illustration

Every leaked credential should be dead, or dying, within sixty seconds of being found. Here’s a proposal to make that the default. (Matt Honea)

+ Flipboard + Reddit [+ Whatsapp](https://web.whatsapp.com/send?text=Ivanti Zero-Day Chain Gave Attackers Root Access to Fully Patched VPN https://www.securityweek.com/ivanti-zero-day-chain-gave-attackers-root-access-to-fully-patched-vpn/) [+ Whatsapp](whatsapp://send?text=Ivanti Zero-Day Chain Gave Attackers Root Access to Fully Patched VPN https://www.securityweek.com/ivanti-zero-day-chain-gave-attackers-root-access-to-fully-patched-vpn/) + Email

Security Community

Stay Intouch

About SecurityWeek

News Tips

Got a confidential news tip? We want to hear from you.

Submit Tip

Advertising

Reach a large audience of enterprise cybersecurity professionals

Subscribe to the SecurityWeek Daily Briefing and get the latest content delivered to your inbox.

Ivanti Zero-Day Chain Gave Attackers Root Access to Fully Patched VPN

Vulnerabilities