Ivanti Connect Secure Zero-Day Chain Reaches Root
Volexity found an Ivanti Connect Secure zero-day chain that gave one attacker unauthenticated root on a VPN appliance running the latest build at the time. Ivanti has fixed two of the three flaws. As of October 14, the third, the privilege escalation that turns a web-server foothold into root, has no fix. Ivanti’s own Integrity Checker Tool does not catch this attack.
What Happened
Volexity began investigating a customer’s appliance on October 5. It ran Connect Secure 22.8R2.4, the newest build then available, and the attacker, tracked as UTA0576, had been inside since at least October 3. The Ivanti Connect Secure zero-day chain has three parts. The first is an authentication bypass: a request to the login page passes the check on its URL, while an HTTP header names a protected internal script as the real target. The second is a race condition that lets the attacker upload a Perl script disguised as a ZIP file and run it before the server deletes it. The third hijacks a root-level maintenance service and lifts the web-server account to root. The first two are tracked together as CVE-2026-104935 (CVSS 8.6), which CISA added to its Known Exploited Vulnerabilities catalog on October 13, due October 16. Ivanti confirms limited exploitation and says some customers were compromised before disclosure.
Ivanti has fixed CVE-2026-104935. CISA lists 25.1.1.1 and prior, 25.1.2.2 and prior, and 22.8R2.4 and prior as affected. The CVE record, as quoted by The Hacker News, lists 22.8R2.5, 25.1.3.0 and 25.1.3.1 as unaffected. Confirm the build numbers in Ivanti’s advisory; we did not open it. For the privilege escalation, Ivanti is working on an update that Volexity says will arrive in the coming weeks. Volexity’s indicators from its one incident: many requests to /dana-na/auth/url_default/welcome.cgi, an X-DSCGI-PATH header that does not match the URL path, and a directory named /data/.icscap/.
Why It Matters
The Integrity Checker Tool checks files on disk. This exploit changes code in memory and restores the configuration data it touched, so a clean result proves little. CISA says confirming a compromise takes network and memory forensics. The attacker left no web shell, reran the chain for every command and deleted selected log entries, so little persists.
After getting in, UTA0576 went for credentials. Using the appliance’s own service account, it searched Active Directory for LAPS local administrator passwords and BitLocker recovery keys, captured cleartext LDAP credentials passing through the device, and ran password spraying. Volexity assesses this as preparation for lateral movement and sees a criminal rather than espionage motive with low confidence. No public victim count exists.
Ivanti told CyberScoop it found part of the flaw internally in June and scheduled the fix for its normal release cycle, because nothing was exploited yet and the issue “did not meet the threshold for an out-of-band release.” For DACH we found no known victims and no exposure data. Assessment: a remote-access gateway that holds a directory service account is a domain-credential store at the network edge, and the third SonicWall flaw we covered earlier this week shows the same pattern.
What You Should Do Now
- Upgrade to a fixed build (22.8R2.5, 25.1.3.0 or 25.1.3.1 per the CVE record) and confirm the numbers in Ivanti’s advisory.
- Do not accept a clean Integrity Checker result as clearance. Search access logs since late September for the indicators above and plan network and memory forensics for exposed appliances.
- If indicators match, follow CISA’s recovery procedure: back up the configuration, factory reset and upgrade (rebuild virtual instances), restore the configuration, then reset all domain, administrator and local passwords, reissue stored certificates and reset API keys and license-server credentials. Check who read BitLocker recovery keys.
- Cut the appliance’s directory account back to the minimum it needs. As of October 14, no fix exists for the privilege escalation. CISA also notes that Connect Secure 22.8 reaches end of life on January 31, 2027, so plan the move to 25.x.
DIESEC Perspective
A VPN appliance with an over-privileged LDAP account turns one flaw into a domain problem. Scope that account before the next advisory arrives.
Not sure whether your remote-access appliances or their directory service accounts have this gap? Contact DIESEC for a rapid compromise assessment and a service-account review.
Sources: The Hacker News | CyberScoop | Security Affairs | Volexity
Published: 2026-10-16 | Category: Vulnerabilities & Patches | ~4 min read
