Hackers chained three zero-days to hit fully patched Ivanti VPN devices

When Volexity began examining suspicious activity at an unnamed Network Security Monitoring customer on 5 October 2026, it found an attacker already using three previously unknown flaws to take root-level control of an Ivanti Connect Secure device. The appliance was fully patched, running version 22.8R2.4, Build 19097, yet UTA0576 had been exploiting it since 3 October.

The episode is best read as a race between patching and an attack method designed to leave little behind. CVE-2026-104935 is a high-severity authentication bypass in Ivanti Connect Secure, the SSL virtual private network formerly sold as Pulse Connect Secure and originally as Juniper Pulse. It lets a remote attacker without credentials run arbitrary commands through a low-complexity attack requiring no user interaction.

Defused independently found the first signs of exploitation on 1 October 2026, an earliest date confirmed by Sean Koessel, Volexity’s vice president of professional services.

Ivanti had identified part of what became CVE-2026-104935 in internal security checks in June 2026. The company concluded then that the issue did not meet the threshold for an immediate out-of-band release.

The flaw affects Ivanti Connect Secure versions 22.8R2.4 and earlier, 25.1.2.2 and earlier, and 25.1.1.1 and earlier.

UTA0576’s chain paired the authentication bypass with a remote-code-execution flaw and a privilege-escalation flaw. Together, the three zero-days gave the actor unauthenticated root-level code execution on fully patched devices.

The authentication bypass stemmed from the appliance’s handling of routed requests. By sending a request to /dana-na/auth/url_default/welcome.cgi and using the X-DSCGI-PATH header, an attacker could direct it to arbitrary CGI files.

For remote code execution, the attackers could submit a Perl script labelled with a.zip extension to the upload handler. The handler saved the upload to disk before establishing whether the file was a valid ZIP.

From there, the attackers extracted credentials stored on the device, including domain credentials used with LDAP. They used custom Kerberos and Python LDAP tools to search Active Directory for LAPS local administrator passwords and BitLocker recovery keys, carried out password spraying and captured LDAP traffic.

The group used the exploit chain itself as its channel. Commands and their results moved through HTTPS requests, rather than through separate command-and-control infrastructure, while the attackers repeatedly re-exploited the device for each command.

UTA0576 deployed no malware, web shell or persistent backdoor. Its commands ran in memory, and it sought to erase the trail through memory-only changes, configuration restoration, selective deletion of Ivanti debug and Linux audit logs, and artifact cleanup.

An Evoxt VPS was observed running OpenVPN from 30 September through 7 October 2026 and was linked to the operation.

Ivanti told customers on Tuesday to patch immediately and acknowledged limited exploitation in the wild. It released fixes for the authentication-bypass and remote-code-execution components on 13 October 2026, while a separate fix for the privilege-escalation flaw remained pending.

The limitation matters for incident response as well as prevention. Ivanti’s Integrity Checker Tool cannot reliably identify compromise where commands ran in memory.

On 13 October 2026, the US Cybersecurity and Infrastructure Security Agency added CVE-2026-104935 to its known exploited vulnerabilities catalog. It classified exploitation as active and automatable with total technical impact, and directed US federal civilian agencies to address the flaw and conduct forensic triage by 16 October 2026.

More than 5,500 Ivanti Connect Secure instances remain reachable on the internet, while Ivanti lists more than 40,000 customers.

CISA has flagged 36 actively exploited vulnerabilities across Ivanti products since November 2021. At least 12 have been used by ransomware gangs.