Fala com um especialista
PreçosNotíciasFala com um especialista
Voltar à sala de imprensa
Ameaças

Ivanti Connect Secure zero-day chain gives attackers root — one fix still missing

An attacker chained three Ivanti Connect Secure zero-days to run commands as root without logging in, on an appliance that was fully patched. Two flaws are fixed; the privilege escalation is not. Here's what to check and do now.

4T4Tify Team4Tify
Oct 13, 2026·5 min de leitura
Ivanti Connect Secure zero-day chain gives attackers root — one fix still missing

Ivanti Connect Secure zero-day chain gives attackers root — one fix still missing

A threat actor has strung together three previously unknown vulnerabilities in Ivanti Connect Secure to execute commands as root on the VPN appliance without ever logging in. Ivanti has shipped fixes for two of the three flaws. The third — the step that escalates to root — is still waiting for a patch.

The research was published on 13 October 2026 by incident-response firm Volexity, which found the intrusion on a customer appliance and reported the flaws to Ivanti. Ivanti has acknowledged "limited exploitation in the wild."

What happened

  • Exploitation began on 3 October 2026, by an actor Volexity tracks as UTA0576.
  • The victim appliance was fully patched at the time, running 22.8R2.4 — this was a true zero-day.
  • The first two flaws — an authentication bypass and a remote code execution bug — are tracked together as CVE-2026-104935 (CVSS 8.6). Combined, they give code execution as the appliance's cgi-server user.
  • A third flaw, a local privilege escalation, lifts that access to root. Ivanti says a fix will arrive in a future release "in the coming weeks." No CVE identifier has been publicly listed for it yet.
  • CISA's enrichment of the CVE record marks exploitation as active and the technical impact as total.

Per the CVE record, Connect Secure versions before 25.1.3.0 are affected. Version 22.7R2.14 and earlier is listed as not affected, as are 22.8R2.5, 25.1.3.0 and 25.1.3.1. Ivanti's own advisory remains the authoritative reference for affected builds and fixes.

What the attacker did once inside

In the one incident investigated, the intruder harvested credentials stored on the appliance — including LDAP domain credentials — searched Active Directory for passwords, and ran password-spraying against domain accounts. No web shell or backdoor was dropped; instead, the attacker re-ran the full exploit chain for every command.

Volexity's assessment of motive is low confidence: it leans towards financially motivated crime rather than espionage. Neither Volexity nor Ivanti has said how many customers were hit.

Why it matters

Edge VPN appliances sit at the boundary of the corporate network and hold the keys to it — directory credentials, session data and trusted network position. Three points make this case especially uncomfortable:

  1. Patched wasn't enough. The compromised box was current at the time of attack.
  2. The built-in check misses it. Ivanti's Integrity Checker Tool (ICT) does not detect this chain: the exploit modifies library code only in memory and restores any configuration data it touches, and the actor took further steps to stay hidden from the tool. A clean ICT result is not proof of a clean appliance.
  3. No stated workaround, no stated clean-up guarantee. Neither vendor nor researcher has published an interim mitigation for those who cannot upgrade, nor confirmed whether upgrading evicts an attacker who already has access.

Because the actor went after directory credentials, a compromised VPN gateway should be treated as a potential identity compromise of the wider domain, not just a device problem.

What to do

  1. Inventory every Connect Secure appliance and its exact version. Prioritise anything below 25.1.3.0.
  2. Upgrade now to a release Ivanti lists as fixed for CVE-2026-104935, and track the advisory for the privilege-escalation fix — apply it as soon as it ships.
  3. Hunt for the published indicators (from the single investigated incident — absence is not proof of safety):
    • unusually high volumes of requests to /dana-na/auth/url_default/welcome.cgi;
    • requests carrying an X-DSCGI-PATH header whose value does not match the requested URL path;
    • the presence of the directory /data/.icscap/;
    • connections involving 108.165.147[.]64.
  4. Don't rely on ICT alone. Confirming compromise requires proper forensics, including network and memory analysis. Engage incident response if any indicator fires.
  5. Assume credential exposure on suspicion. Rotate the LDAP/service-account credentials configured on the appliance, review AD for password-spraying patterns and anomalous authentication, and enforce MFA on everything reachable from the VPN.
  6. Reduce exposure. Restrict management interfaces, forward appliance logs to your SIEM, and alert on the patterns above.

Also in the same Ivanti release

Ivanti fixed two further critical flaws (each rated CVSS 9.9) with no known exploitation: CVE-2026-106042 in Xtraction (versions before 2026.4) and CVE-2026-109412 in Neurons Patch for Intune. Patch them on your normal critical cadence.

Need to know whether your internet-facing edge — VPNs, gateways, remote-access portals — is exposed? 4Tify's vulnerability assessments identify vulnerable versions and misconfigurations before attackers do.

Reporting credit: The Hacker News. Technical findings from Volexity's research and Ivanti's security advisory.

PARTILHAR