Ivanti Connect Secure zero-days chained for root access

Attackers chained three zero-day flaws in Ivanti Connect Secure to run commands as root without logging in, Ivanti and the security firm Volexity disclosed on October 13, 2026. Connect Secure is a VPN appliance that companies put at the edge of their networks so staff can connect remotely. Ivanti has fixed two of the flaws, tracked together as CVE-2026-104935. The third, which raises the attacker to root, has no fix yet.

How the attack worked

Volexity found the attack on one customer's appliance, which was fully patched and running version 22.8R2.4, The Hacker News reports. Volexity tracks the unknown attacker as UTA0576 and says it began exploiting that device on October 3. The threat intelligence firm Defused saw the first signs of exploitation from October 1, according to BleepingComputer.

The chain has three steps:

1. Authentication bypass. The attacker gets in without a password.
2. Remote code execution. The attacker runs commands on the appliance.
3. Privilege escalation. Those commands then run as root, the all-powerful system account.

The first two are covered by CVE-2026-104935, which Ivanti scores 8.6 out of 10. Ivanti expects to fix the third "in a future release in the coming weeks," Volexity said.

Once inside, the attacker stole stored credentials, including domain logins, and ran password-spraying attacks, The Hacker News reports. According to iTnews, it also searched for local admin passwords and BitLocker recovery keys and captured plaintext credentials from VPN traffic.

Which versions are affected

Rapid7 lists these affected versions and their fixes:

Affected version	Fixed in
22.8R2.4	22.8R2.5
25.1.1.1	25.1.1.2
25.1.2.2	25.1.3.0 or 25.1.3.1
22.7.x and earlier	Not affected

Ivanti found part of the flaw through its own security program and fixed it in 25.1.3.0 in July, Rapid7 says. The attacks happened while Ivanti was still bringing that fix to older versions. Ivanti told CyberScoop the flaw "did not meet the threshold for an out-of-band release," so the fix shipped on its normal schedule.

The US Cybersecurity and Infrastructure Security Agency (CISA) added the flaw to its list of known exploited bugs on October 13. Federal agencies must patch by October 16, iTnews reports.

Why the usual check may miss it

The attacker left almost nothing behind. It deployed no malware or web shell, Volexity says. Instead, it re-ran the whole chain for every command and tampered with the device's logs.

The exploit also changes code only in memory and restores the settings it alters, The Hacker News reports. That let it slip past Ivanti's Integrity Checker Tool, the scanner Ivanti tells customers to run. CISA has warned that the tool may not detect this attack, so it advises network and memory forensics instead, CyberScoop reports.

Volexity believes, with medium confidence, that the attacker used AI models to build its tools, iTnews says. It has low confidence that the motive is criminal rather than spying.

"Edge devices are a valuable initial foothold and often enable attackers to pivot further into targeted networks," Sean Koessel, Volexity's vice president of professional services, told CyberScoop.

A familiar target

Ivanti describes the attacks as "limited exploitation in the wild." Neither company has said how many customers were hit. Shadowserver, a nonprofit that scans the internet, tracks more than 5,500 Connect Secure appliances reachable online, BleepingComputer says.

This is not the first time. CISA's list has included 36 Ivanti flaws since November 2021, according to BleepingComputer, and ransomware gangs abused 12 of them.

What this means for developers

For teams that run or depend on Ivanti Connect Secure:

• Patch now, not at the next window. "If you are running one of the impacted versions, Ivanti recommends you act immediately." Rapid7 also advises patching outside normal cycles.
• Assume patching is not the end. The third flaw is still open, and a patched device may already be compromised. Check for signs of compromise after you upgrade.
• Do not trust the checker alone. The Integrity Checker Tool missed this chain. Look at network traffic from the appliance, and use memory forensics where you can.
• Rotate what the VPN could see. The attacker took domain credentials and sniffed passwords from VPN traffic. Reset service-account passwords and review recent logins that came through the appliance.
• Watch for the third fix. Ivanti has promised it in the coming weeks. Until then, limit who can reach the appliance's login page.