Ivanti Zero-Day Exploit Chain Grants Root Access on Connect Secure
Hackers chain three vulnerabilities while a crucial privilege escalation patch remains pending.
1Three Zero-Days Chained
Security researchers at Volexity discovered a threat actor chaining three zero-day vulnerabilities in Ivanti Connect Secure. The initial attack began targeting fully patched appliances running version 22.8R2.4. This sequence allows an unauthenticated external attacker to execute arbitrary system commands with root privileges directly on the targeted appliance.
2Anatomy of the Exploit
The attack sequence combines authentication bypass and remote code execution, tracked as CVE-2026-104935, to execute code under the cgi-server user context. A third vulnerability escalates these privileges to root. Ivanti released security fixes for the first two flaws, but a dedicated patch for privilege escalation remains pending.
3Evasion of Integrity Tools
Ivanti advised customers to run its Integrity Checker Tool regularly, but Volexity reported that the tool fails to detect this specific chain. The threat actor modified library code strictly in system memory and immediately restored altered configuration files, deliberately circumventing local file integrity verification and standard detection mechanisms.
4Credential Theft and Reconnaissance
During the investigated breach, the adversary stole stored LDAP domain credentials from memory and queried Active Directory environments for administrative passwords. Rather than leaving persistent web shells or backdoor files, the actor executed each operational command by replaying the complete unauthenticated exploit chain across network boundaries.
5Forensic Visibility Challenges
Because the intrusion left no traditional on-disk artifacts, confirming a compromise requires comprehensive network analysis and memory forensics. Neither Ivanti nor Volexity published temporary mitigation workarounds for environments unable to deploy updates immediately. Furthermore, applying current patches does not remediate access if systems are already compromised.
6Threat Profile and Attribution
Volexity tracks the threat group responsible as UTA0576, assessing with low confidence that their primary operational motive is financially driven cybercrime rather than state-backed cyber espionage. Neither vendor disclosed the total number of impacted enterprise customers, though Ivanti confirmed limited active exploitation occurring in the wild.
7Severity Ratings and Impact
Ivanti assigned CVE-2026-104935 a CVSS severity score of 8.6 out of 10. The Cybersecurity and Infrastructure Security Agency confirmed active exploitation in production networks, categorizing the technical impact as total. Exploitation grants full administrative control over the appliance, exposing internal connected corporate networks to lateral movement.
8Broader Appliance Exposure
Alongside Connect Secure, Ivanti disclosed critical 9.9 severity vulnerabilities across other enterprise tools, including Xtraction and Neurons Patch for Intune. While those specific flaws show no documented active exploitation yet, this multi-flaw campaign highlights persistent operational risks targeting edge infrastructure and administrative network gateways.