Ivanti Connect Secure Zero-Day Chain Gives Attackers Root on Patched VPNs: What Enterprise Teams Should Do

Marcus Chen Staff Engineer (Backend & Cloud), YuSMP Group · Hardens enterprise and cloud stacks for US and EU teams

The short version

What happened to Ivanti Connect Secure?

Volexity says it started investigating a suspicious Connect Secure appliance on October 5 and found an attacker running commands as root on a device that had every available update installed. The group, which Volexity tracks as UTA0576, had been exploiting the appliance since at least October 3; other reports put the earliest confirmed exploitation at October 1. Ivanti says a limited number of customers were compromised before disclosure.

Ivanti released fixes on October 13. According to CyberScoop, the company had found at least part of the problem internally in June but judged it did not warrant an out-of-band release and scheduled the fix for a normal product cycle — a decision attackers overtook. CISA added CVE-2026-104935 to its Known Exploited Vulnerabilities catalog the same day, giving US federal civilian agencies a three-day window to remediate.

How does the exploit chain work?

The chain has three links. The first is an authentication bypass in the appliance's welcome.cgi handler that lets an unauthenticated request be routed to other CGI scripts. The second is a file-write bug in wu.cgi, which turns that access into remote code execution. Ivanti covers both under CVE-2026-104935 and stresses that it has “fully addressed the unauthenticated remote code execution component.”

The third link is a privilege escalation that lifts the attacker from the web process to root. Ivanti has confirmed it but has not yet shipped a fix or assigned a public CVE. In practice the patch breaks the chain at its entry point, which is why applying it is urgent. But any other foothold on the appliance — a stolen admin session, a future web bug — would still reach root until the next release lands.

Why is this intrusion so hard to spot?

UTA0576 did not install a web shell or a persistent backdoor. Volexity found the attacker re-ran the full exploit chain for every command, patched Ivanti library code in memory only, restored the configuration store afterwards and wiped its traces from the device logs. Because nothing changes on disk, Ivanti's Integrity Checker Tool — the check many teams were told to rely on after earlier Connect Secure incidents — reports the device as clean.

What the attacker did with that access is the bigger worry. Volexity describes credential extraction, Active Directory dumps, Kerberoasting, LDAP queries for LAPS local administrator passwords and BitLocker recovery keys, password spraying and packet capture of LDAP traffic. In other words, the VPN was a launch pad into the identity layer, and patching the appliance does not undo anything taken before the fix.

What it means for US & EU teams

Edge devices remain the weakest link in many enterprise networks. VPN gateways sit on the internet, hold privileged credentials and are rarely covered by the endpoint detection that protects laptops and servers. This is the latest in a long run of Connect Secure zero-days, and it shows that “fully patched” is not the same as safe when a vendor's fix cycle trails attackers by months.

For regulated companies the incident also has a reporting angle. An attacker who reached Active Directory, LAPS secrets or BitLocker keys may have touched systems that hold personal, payment or health data. Under GDPR's 72-hour rule, NIS2's early-warning duty or sector rules such as DORA, “we patched on day one” is not enough; teams need evidence of whether exploitation happened before the patch. That means preserved logs from upstream firewalls and proxies, not just the appliance itself.

Longer term, it is a good moment to ask whether a single VPN appliance should still be the front door. Moving remote access toward identity-aware proxies, short-lived credentials and segmented admin paths limits how far one compromised box can reach — and makes the next edge-device zero-day an incident rather than a breach.

What to do this week

1. Patch. Move every Ivanti Connect Secure appliance to 22.8R2.5, 25.1.1.2, 25.1.3.0 or 25.1.3.1.
2. Hunt, don't just scan. Search web and proxy logs for requests to /dana-na/auth/url_default/welcome.cgi carrying an X-DSCGI-PATH header, and check /tmp/ on the appliance for leftover artifacts, as Volexity recommends.
3. Go beyond the Integrity Checker. For devices exposed since early October, plan memory and network forensics or a vendor-assisted review.
4. Rotate secrets. Reset credentials cached on or brokered through the VPN, service accounts open to Kerberoasting, LAPS passwords and BitLocker recovery keys if exposure is suspected.
5. Watch for the third fix. Track Ivanti's advisory for the privilege-escalation update and keep management interfaces off the internet until it ships.

Frequently asked questions

Sources

Volexity — A Series of Unauthenticated Events: Chained Exploitation of Ivanti Connect Secure Zero-Days (October 13, 2026)
CyberScoop — Ivanti misses opportunity to fix vulnerability before attackers made it a zero-day (October 2026)
SecurityWeek — Ivanti Zero-Day Chain Gave Attackers Root Access to Fully Patched VPN (October 2026)
The Hacker News — Attacker Chains Three Ivanti Connect Secure Zero-Days for Root Access (October 2026)