An attacker has utilized three zero-day vulnerabilities in Ivanti Connect Secure, a VPN appliance, to execute commands at the root level without authorization. This was reported by security firm Volexity on October 13, 2026. Ivanti has patched two of these vulnerabilities, urging customers using affected versions to take immediate action. The patch for the third flaw is still under development.
Details of the Exploit
Volexity, who discovered the vulnerabilities, noted that an attack occurred on a customer’s fully updated appliance running version 22.8R2.4. The attacker, identified as UTA0576, started exploiting these vulnerabilities on October 3. Ivanti acknowledged limited instances of these exploits occurring in real-world scenarios as of October 13.
The first two vulnerabilities involve an authentication bypass and remote code execution, collectively known as CVE-2026-104935. These allow an attacker to execute code as the cgi-server user. The third vulnerability involves privilege escalation, enabling elevation to root access, as explained by Volexity.
Impacted Versions and Patches
According to Ivanti’s CVE record, certain versions of Connect Secure are impacted. Versions prior to 25.1.3.0 are affected, while versions 22.7R2.14 or earlier remain unaffected. Versions 22.8R2.5, 25.1.3.0, and 25.1.3.1 are listed as safe. Ivanti’s security advisory provides further information on the versions affected and available fixes.
Ivanti is actively developing a solution for the privilege escalation issue, anticipated to be included in an upcoming release. Volexity did not specify the risk level of this flaw on devices where the initial two vulnerabilities have been addressed.
Security Recommendations
Ivanti advises users to upgrade their systems and regularly utilize its Integrity Checker Tool. However, Volexity notes that the tool may not detect this exploit chain since it only modifies library code in memory and restores any changed configuration data. The attacker took measures to avoid detection by the tool.
Detecting a compromise requires thorough forensic analysis, including network and memory examinations. Evidence from Volexity’s investigation includes unusual URL path requests, unexpected HTTP headers, and a specific IP address linked to the attacker.
In the identified incident, the attacker obtained stored credentials, including LDAP domain credentials, and conducted password-spraying attacks. The attack did not leave any backdoors or web shells, as the exploit chain was re-executed for each command.
Current reports from Volexity and Ivanti do not mention any temporary workarounds for customers unable to upgrade, nor do they clarify if upgrading mitigates an attacker’s existing access. Volexity tentatively suggests that the attacker’s motivation is criminal rather than espionage. Neither company disclosed the number of affected users.
Ivanti rated the severity of CVE-2026-104935 as 8.6 on the CVSS scale. Meanwhile, CISA categorized the exploitation as “active” with a “total” technical impact.
Additionally, Ivanti addressed vulnerabilities in two other products, Xtraction and Neurons Patch for Intune, which have not been exploited according to current knowledge. These are rated 9.9 out of 10: CVE-2026-106042 in Xtraction prior to version 2026.4 and CVE-2026-109412 in Neurons Patch for Intune.
