Ivanti Connect Secure zero-days allow root access via chained exploits

Security researchers have identified a active exploitation campaign targeting Ivanti Connect Secure VPN appliances. On October 13, security firm Volexity reported that an attacker chained three zero-day vulnerabilities to execute commands as the root user without authentication. While Ivanti has released patches for two of these flaws, a fix for the third remains unavailable, leaving some systems vulnerable despite updates.

What happened

Volexity discovered the attack on a customer’s appliance that was running version 22.8R2.4. Although this version was considered fully patched at the time, the attacker, tracked as UTA0576, began exploiting the system on October 3. The attack chain involves two initial flaws, tracked together as CVE-2026-104935, which include an authentication bypass and a remote code execution vulnerability. These allow an attacker to run code as the cgi-server user. A third flaw, a privilege escalation vulnerability, then elevates those permissions to root access.

Ivanti has acknowledged limited exploitation in the wild and urged customers to act immediately. The company released fixes for the authentication bypass and remote code execution components in version 25.1.3.0, which was dated July 2026. However, the privilege escalation flaw remains unpatched, with Volexity stating that a fix will arrive in a future release in the coming weeks. It is currently unclear what risk the remaining flaw poses if the first two are already mitigated.

The attack method is particularly stealthy. Volexity noted that Ivanti’s Integrity Checker Tool fails to detect this specific exploit chain because the attacker modifies library code only in memory and restores configuration data after use. This means standard integrity checks may return clean results even while the system is compromised. Confirming a breach requires deep forensic investigation, including network and memory analysis, rather than relying solely on automated tools.

Key details

• Affected versions: Connect Secure versions before 25.1.3.0 are affected, except for version 22.7R2.14 and prior, which are listed as not affected.
• Patched versions: Versions 22.8R2.5, 25.1.3.0, and 25.1.3.1 are listed as unaffected by the initial CVE record.
• Active exploitation: The U.S. Cybersecurity and Infrastructure Security Agency (CISA) marks the exploitation as active with a total technical impact.
• Stealth techniques: The attacker reruns the entire exploit chain for each command and leaves no backdoor or web shell, making detection difficult.
• Data theft: In the investigated incident, the attacker stole LDAP domain credentials and performed password-spraying attacks against Active Directory accounts.
• Other vulnerabilities: Ivanti also patched critical flaws in Xtraction (CVE-2026-106042) and Neurons Patch for Intune (CVE-2026-109412), though no exploitation has been reported for these.

Background

Zero-day vulnerabilities are security flaws that are unknown to the vendor and have no available patch at the time of discovery. When attackers chain multiple zero-days together, they can bypass layered defenses that might stop a single exploit. In this case, the chain moves from bypassing authentication to executing code, and finally to gaining full administrative control. This progression is dangerous because it allows an attacker to operate with the highest level of privileges on the network appliance.

Privilege escalation is a common goal in such attacks. Once an attacker gains a foothold with limited permissions, they seek to elevate their status to root or administrator. This grants them the ability to modify system configurations, install persistent malware, or access sensitive data stores like credential databases. The fact that this specific exploit operates in memory makes it harder to detect with traditional file integrity monitoring, which typically checks for changes on disk rather than in active RAM.

Why it matters

For teams managing their own remote access infrastructure, this incident highlights the limitations of relying solely on vendor-provided integrity tools. If your organization uses Ivanti Connect Secure, simply running the Integrity Checker Tool may provide a false sense of security. The stealthy nature of this attack means that compromised systems can continue to operate normally while attackers exfiltrate credentials. This is particularly risky for organizations that store LDAP or Active Directory credentials on the appliance, as these can be used to pivot deeper into the corporate network.

The delay in patching the third vulnerability creates a window of uncertainty. Even if you upgrade to the latest version to fix the first two flaws, the privilege escalation vector remains open until the next release. This forces IT leaders to balance the urgency of applying available patches against the risk of the remaining exposure. It also underscores the need for robust network monitoring and forensic capabilities, as automated alerts may not trigger during the initial compromise.

What you can do

• Upgrade immediately: If you are on an affected version, upgrade to 25.1.3.0 or later to patch the authentication bypass and remote code execution flaws.
• Monitor for IOCs: Check your logs for high volumes of requests to /dana-na/auth/url_default/welcome.cgi with mismatched X-DSCGI-PATH headers.
• Check for suspicious directories: Look for the presence of the /data/.icscap/ directory, which was used in the investigated incident.
• Block known malicious IPs: Consider blocking IP 108.165.147[.]64 at your firewall if it appears in your traffic logs.
• Conduct forensic analysis: Do not rely solely on the Integrity Checker Tool; perform memory and network forensics if you suspect compromise.
• Rotate credentials: If you suspect any exposure, rotate LDAP and Active Directory passwords immediately to prevent password-spraying attacks.