Ivanti Connect Secure zero-day chain exploited for root access, one flaw still unpatched

Ivanti has released fixes for an actively exploited zero-day in its Connect Secure (ICS) VPN appliances, tracked as CVE-2026-104935, after security firm Volexity found an attacker chaining it with two other flaws to gain unauthenticated, root-level code execution on a fully patched device. According to BleepingComputer, The Hacker News and SecurityWeek, one link in the chain, a privilege escalation bug, remains unpatched. CISA added CVE-2026-104935 to its Known Exploited Vulnerabilities catalog on October 13.

What happened

Volexity discovered the activity while investigating an incident at one of its customers and reported the flaws to Ivanti, the outlets said. The firm tracks the previously undocumented actor as UTA0576 and found evidence of exploitation starting October 3. BleepingComputer reports that Defused confirmed the findings and said it first observed exploitation from October 1. Ivanti said it is aware of "limited exploitation in the wild" affecting a limited number of customers and is working directly with them. Neither company disclosed how many organizations were hit.

Volexity assesses with low confidence that the actor is financially motivated rather than conducting espionage, and, according to SecurityWeek, with medium confidence that UTA0576 uses large language models for exploit development and post-exploitation.

Technical details

According to The Hacker News, CVE-2026-104935 covers two of the three chained flaws, an authentication bypass and a remote code execution bug, which together let an unauthenticated attacker run code as the appliance's cgi-server user. Ivanti rates it 8.6 out of 10. The third flaw escalates that access to root; Volexity said Ivanti plans to fix it "in the coming weeks."

The attacker deployed no web shell or backdoor. Instead, it re-ran the entire exploit chain for each command, modified library code only in memory and tampered with logs, which allowed it to evade Ivanti's Integrity Checker Tool. Volexity says confirming compromise requires network and memory forensics. Indicators shared by The Hacker News include large numbers of requests to /dana-na/auth/url_default/welcome.cgi with an X-DSCGI-PATH header that does not match the URL path, the directory /data/.icscap/ and the IP address 108.165.147[.]64.

Once inside, UTA0576 stole domain credentials stored on the appliance, searched Active Directory for LAPS passwords and BitLocker recovery keys, ran password-spraying attacks and scanned the network, SecurityWeek reported. Volexity believes with high confidence that the actor was preparing for lateral movement.

Who is affected

BleepingComputer lists ICS 22.8R2.4 and earlier, 25.1.2.2 and earlier, and 25.1.1.1 and earlier as affected. Shadowserver tracks more than 5,500 internet-exposed ICS instances, although it is unclear how many are honeypots or already secured.

What to do

Ivanti urges customers on affected versions to "act immediately" and upgrade to fixed releases 22.8R2.5, 25.1.1.2, 25.1.3.0 or 25.1.3.1. Because the privilege escalation flaw remains open and the chain bypasses the Integrity Checker Tool, organizations should hunt for the published indicators, review VPN and authentication logs for password spraying, and rotate credentials stored on the appliance, including LDAP service accounts. In the same advisory, Ivanti also fixed CVE-2026-106042 in Xtraction and CVE-2026-109412 in Neurons Patch for Intune, both rated 9.9 and not known to be exploited.