An attacker has been breaking into fully patched Ivanti Connect Secure VPN appliances without logging in, chaining three previously unknown vulnerabilities into full root access.
Security firm Volexity disclosed the attack chain on October 13, 2026, and Ivanti released fixes for two of the three flaws the same day. The third, a privilege-escalation bug, is still unpatched.
The attack was found on a customer's appliance running Connect Secure version 22.8R2.4, fully patched at the time. Volexity, which tracks the intruder as UTA0576, said exploitation began on October 3, ten days before public disclosure.
Ivanti acknowledged it is aware of limited exploitation in the wild, and the U.S. Cybersecurity and Infrastructure Security Agency added the flaws to its Known Exploited Vulnerabilities catalog on October 13.
Three flaws, one root shell
The chain starts with two vulnerabilities tracked together as CVE-2026-104935: an authentication bypass by spoofing and a remote code execution flaw.
The authentication bypass carries a CVSS score of 8.6 and lets a remote, unauthenticated attacker execute arbitrary commands as the appliance's cgi-server user. The third flaw, a privilege escalation, raises that access to root.
The attack works entirely through the exploit channel, Volexity said. The intruder did not install a backdoor or a web shell.
Instead, the attacker modified in-memory library code and cleaned up artifacts afterward, which means Ivanti's Integrity Checker Tool may not detect the compromise. Organizations suspecting an incident will need network and memory forensics to find evidence of exploitation.
What the attacker was after
In the incident Volexity investigated, the intruder targeted stored credentials: Active Directory credentials, LAPS passwords, BitLocker recovery keys and LDAP authentication data. The attacker also conducted password-spraying attacks and network reconnaissance, presumably to pivot deeper into the victim's environment.
Rapid7 recommended that organizations running affected versions patch on an emergency basis, outside of normal patching cycles. Ivanti said customers on affected versions should act immediately and rebuild compromised appliances from clean configurations after a factory reset.
A product with a history
Connect Secure, Ivanti's enterprise VPN product, sits on the edge of corporate networks and has long been a favorite target. The product was hit by zero-day exploitation campaigns in both 2024 and 2025, and more than a dozen Ivanti Connect Secure and Pulse Connect Secure flaws are already listed on CISA's Known Exploited Vulnerabilities catalog.
Versions before 25.1.3.0 are affected, except 22.7R2.14 or earlier. Ivanti lists 22.8R2.5, 25.1.3.0 and 25.1.3.1 as unaffected, and said a fix for the privilege-escalation flaw is planned for a future release.
Neither Ivanti nor Volexity disclosed how many customers were attacked, or offered a temporary workaround for organizations that cannot upgrade immediately.
For defenders, the lesson is an old one restated with new urgency: edge devices like VPN gateways are the front line, and a fully patched appliance is no longer proof that attackers are not already inside.
By Hamza Faisal
