Ivanti Connect Secure Exploited via Three Zero-Day Vulnerabilities
An attacker tracked as UTA0576 exploited three zero-day vulnerabilities in Ivanti Connect Secure to achieve unauthenticated root-level access, with exploitation detected as early as October 3, 2026.
Exploitation Details and Timeline
An attacker tracked by Volexity as UTA0576 has exploited three zero-day vulnerabilities in Ivanti Connect Secure, a widely used VPN appliance, to achieve unauthenticated root-level access. According to Volexity, the exploitation began as early as October 3, 2026, with the first signs of the CVE-2026-104935 vulnerability being detected on October 1 by threat intelligence firm Defused. The attack chain involves CVE-2026-104935 and two other unpatched flaws, allowing remote threat actors to execute arbitrary commands on fully patched devices without user interaction. Ivanti has acknowledged limited exploitation in the wild at the time of disclosure. The vulnerabilities affect internet-exposed instances of Ivanti Connect Secure, as noted by Shadowserver. As of now, only two of the three flaws have been patched, leaving systems potentially exposed to further attacks.
Affected Versions and Patch Status
According to Ivanti's security advisory, the Connect Secure versions affected by the vulnerability are those before 25.1.3.0. Versions 22.7R2.14 or earlier, 22.8R2.5, 25.1.3.0, and 25.1.3.1 are listed as unaffected. The CVE record, tracked as CVE-2026-104935, indicates that the high-severity authentication bypass zero-day affects versions 22.8R2.4 and earlier, 25.1.2.2 and earlier, and 25.1.1.1 and earlier. Ivanti has issued patches for two of the flaws exploited in the attack chain, but a privilege escalation vulnerability remains unpatched. Volexity's report and Ivanti's post do not provide a temporary workaround for customers who cannot upgrade immediately. Customers are advised to review the security advisory, upgrade to the fixed version as soon as possible, and run the Integrity Checker Tool regularly.
Impact and Mitigation
CISA has marked the exploitation of the Ivanti Connect Secure vulnerabilities as 'active' with a technical impact described as 'total,' according to the agency. Ivanti has rated one of the flaws, CVE-2026-104935, as having a severity score of 8.6 out of 10 on the CVSS scale. In one incident, attackers accessed the URL path /dana-na/auth/url_default/welcome.cgi, used an HTTP header X-DSCGI-PATH with mismatched values, and targeted the /data/.icscap/ directory from an IP address 108.165.147[.]64. The attacker stole credentials, searched Active Directory, and conducted password-spraying attacks. CISA has also flagged 36 Ivanti vulnerabilities as actively exploited since November 2021. Ivanti has released patches for other products, but it is not aware of those flaws being exploited.
Additional Vulnerabilities and Fixes
In addition to the three zero-day vulnerabilities exploited in the attack chain, Ivanti has identified and addressed several other critical flaws in its Connect Secure product line. According to evidence, Ivanti rates each of the flaws as 9.9 out of 10 in severity, including CVE-2026-106042 in Xtraction before version 2026.4 and CVE-2026-109412 in Neurons Patch for Intune. Earlier in 2024, Ivanti released patches for an authentication bypass (CVE-2023-46805), a command injection (CVE-2024-21887), and a server-side request forgery (CVE-2024-21893). These updates were issued in early January and two weeks later, respectively. Ivanti has also previously patched multiple Connect Secure zero-days that were exploited in the wild, some of which were chained in attacks to deploy malware. The company serves over 40,000 customers globally, highlighting the potential impact of unpatched vulnerabilities.
Threat Actor and Motive Analysis
Cybersecurity firm Volexity has identified a threat actor, tracked as UTA0576, that has chained three zero-day vulnerabilities in Ivanti Connect Secure to achieve unauthenticated root-level access on fully patched devices. The attack chain, which has been active since at least October 3, includes CVE-2026-104935 and two other unpatched flaws. According to Volexity, the attacker has exploited these vulnerabilities to steal stored credentials, including LDAP domain credentials, and conduct password-spraying attacks against Active Directory accounts. The threat actor has also tampered with logs to evade detection by Ivanti’s Integrity Checker Tool. While Ivanti has released patches for two of the flaws, it is still working to address a remaining privilege escalation vulnerability that was part of the same exploit chain. Volexity assessed with low confidence that UTA0576’s motive is criminal, not espionage. The incident highlights the ongoing risks posed by unpatched vulnerabilities in internet-exposed ICS instances, as noted by Shadowserver.
Sources and reporting notes
Based on published source material. No independent hands-on testing is claimed.
