Ivanti VPN Zero-Day Chain Gave Attackers Root on a Fully Patched Appliance, and One Flaw Is Still Unfixed

Attackers chained three previously unknown flaws in Ivanti Connect Secure to gain full control of a VPN appliance that was running the latest patched release, security researchers disclosed this week. Ivanti has fixed two of the flaws, and the US Cybersecurity and Infrastructure Security Agency (CISA) has ordered urgent action. A fix for the third vulnerability is still pending.

Security firm Volexity reported that a previously unknown threat actor, tracked as UTA0576, began exploiting Ivanti Connect Secure appliances on October 3, 2026. Researchers investigated suspicious activity on October 5 and traced it to a device running version 22.8R2.4, which was fully patched at the time. Another security firm saw the first signs of exploitation as early as October 1.

Ivanti confirmed the issue on October 13 and said it was aware of limited exploitation in the wild. The company released updates for CVE-2026-104935, an authentication bypass rated 8.6 on the CVSS scale that allows unauthenticated remote code execution.

The attackers combined three weaknesses: an authentication bypass, a file upload flaw that enabled code execution, and a separate privilege escalation bug. Together, they gave attackers root access, the highest level of control on the appliance. Ivanti's new CVE covers the first two stages. The privilege escalation flaw is a separate vulnerability, and Ivanti says a fix will be released in the coming weeks.

Affected releases include Connect Secure 22.8R2.4 and earlier, 25.1.2.2 and earlier, and 25.1.1.1 and earlier.

According to the researchers, the attackers did not install malware or web shells. Instead, they ran commands directly through the exploit chain, using hard-coded credentials inside scripts that investigators suspect were written with the help of large language models. They re-exploited the device for each command and tampered with logs to cover their tracks, which helped them avoid detection by Ivanti's Integrity Checker Tool. That means a clean scan result may not prove a device is safe.

The activity appears to be criminal rather than espionage-focused, aimed at credential theft, data exfiltration and reconnaissance of internal networks, including Active Directory credentials.

CISA added CVE-2026-104935 to its Known Exploited Vulnerabilities catalogue on October 13, the same day Ivanti published its advisory, and urged administrators to patch. For federal agencies, listing in the catalogue normally comes with a remediation deadline.

This is the third consecutive year in which Ivanti has had to respond to actively exploited zero-days in Connect Secure. It is also part of a broader pattern. In the same week, vendors including Palo Alto Networks, Cisco and Fortinet released emergency fixes for flaws in network and email security products that attackers were already abusing. Edge devices such as VPNs, firewalls and gateways remain prime targets because they sit between the internet and internal networks.

The incident shows that "fully patched" does not always mean safe when a vulnerability is unknown to the vendor. It also suggests attackers are using AI to speed up tooling, a trend defenders expect to grow.