Ivanti VPN Under Attack: Three Zero-Days Chained to Gain Root Access, With One Fix Still Missing

Security firm Volexity said on October 13 that an attacker chained three zero-day flaws in Ivanti Connect Secure, a VPN appliance, to run commands as root without logging in. Volexity found the attack on one customer's appliance, which was fully patched and running version 22.8R2.4. The attacker, tracked as UTA0576, began exploiting it on October 3. Ivanti has released fixes for two of the flaws, told customers on affected versions to "act immediately", and said it is aware of "limited exploitation in the wild." A fix for the third flaw, a privilege escalation bug, is still pending and is due "in a future release in the coming weeks."

The first two flaws, an authentication bypass and a remote code execution flaw, are tracked together as CVE-2026-104935. Together they let an attacker run code as a limited user, and the third flaw raises that access to root. Ivanti advises customers to upgrade and to run its Integrity Checker Tool regularly. However, Volexity says the tool misses this chain, because the exploit changes code only in memory and the attacker took steps to stay hidden from it.

In the incident Volexity investigated, the attacker stole stored credentials, including LDAP domain credentials, searched Active Directory for passwords, and ran password-spraying attacks against accounts. No backdoor or web shell was left behind. Confirming a compromise takes forensic investigation, including network and memory forensics. The reports do not name a temporary workaround for customers who cannot upgrade, nor say whether upgrading removes access an attacker already has.