// AI threat desk · 14 Oct 2026
Home/CVE · Vulns & Patches
Vulns & PatchesHighCVECVSS 8.6

Ivanti Connect Secure flaw could let attackers run commands as root

Three zero-day flaws let UTA0576 reach root access on a fully patched Ivanti Connect Secure appliance, Volexity said.

· 2 min read
AI-generated image of a security analyst monitoring a network appliance and blurred terminal in a dim operations centre.
AI-generated image, not a photo of the event.
Key takeaways
  • Volexity said the first two flaws are an authentication bypass and remote code execution issue tracked as CVE-2026-104935.
  • Volexity said the third flaw raises access from the cgi-server user to root.
  • Ivanti rates CVE-2026-104935 at 8.6 out of 10 on the CVSS severity scale.

Ivanti Connect Secure VPN appliances were targeted with three zero-day flaws that could let an unauthenticated attacker run commands as root. Volexity said it found the activity on one customer’s fully patched appliance running version 22.8R2.4, with exploitation beginning on October 3.

The activity exposed domain credentials stored on the appliance and limited Active Directory metadata, while the attackers searched for LAPS passwords and BitLocker recovery keys. Volexity also said they scanned the network, collected configuration data and parsed authentication logs to identify valid usernames.

Ivanti said it is aware of exploitation affecting a limited number of customers, while Volexity said the operation was detected and disrupted before the attackers’ ultimate goals became clear.

On this page

CVE-2026-104935 chained authentication bypass and code execution

Volexity said the first two flaws let an attacker run code as the appliance’s cgi-server user. A separate privilege-escalation flaw then raises that access to root.

Ivanti released four Connect Secure versions with patches

Ivanti said it released fixes for two of the three flaws and patched the vulnerabilities in Connect Secure versions 22.8R2.5, 25.1.1.2, 25.1.3.0 and 25.1.3.1.

Ivanti tells customers to upgrade and run its Integrity Checker Tool regularly. The vendor also warned that the zero-day vulnerability had been exploited in the wild and said it was aware of limited exploitation.

Volexity assessed UTA0576 was preparing wider network compromise

Volexity tracks UTA0576 as a previously undocumented threat actor. It said the attackers obtained domain credentials stored on the appliance and exfiltrated limited Active Directory metadata.

Volexity assessed with medium confidence that UTA0576 uses large language models for exploit development and post-exploitation activity. It assessed with low confidence that the motive was criminal rather than espionage.

Volexity found no backdoor or web shell on the device. It assessed with high confidence that the activity pointed to preparation for lateral movement and a wider network compromise, but said the operation ended before its ultimate goals were clear.

What to do now

  1. Upgrade and run Ivanti’s Integrity Checker Tool regularly.

FAQ

Is CVE-2026-104935 being exploited?

Ivanti said it was aware of limited exploitation in the wild, and Volexity found evidence of exploitation beginning on October 3.

Which Ivanti Connect Secure versions are patched?

Ivanti patched the vulnerabilities in versions 22.8R2.5, 25.1.1.2, 25.1.3.0 and 25.1.3.1. The privilege-escalation flaw remains unpatched.

What could attackers access through the flaws?

Volexity said the attackers obtained domain credentials and limited Active Directory metadata, and searched for LAPS passwords and BitLocker recovery keys.

Who is UTA0576?

Volexity tracks UTA0576 as a previously undocumented threat actor. It assessed with medium confidence that the group uses large language models for exploit development and post-exploitation activity.

Sources

  1. Attacker Chains Three Ivanti Connect Secure Zero-Days for Root Access, Only Two Patched So Far, The Hacker News
  2. Ivanti Zero-Day Chain Gave Attackers Root Access to Fully Patched VPN, SecurityWeek
How we checked this story
ClaimSourceStatus
Volexity said an attacker chained three zero-day flaws in Ivanti Connect Secure to run commands as root without logging in.Volexity, via The Hacker NewsAttributed
Volexity found the attack on one customer’s fully patched appliance running version 22.8R2.4.Volexity, via The Hacker NewsAttributed
The attacker, tracked by Volexity as UTA0576, began exploiting the appliance on October 3.Volexity, via The Hacker NewsAttributed
Ivanti said it was aware of limited exploitation in the wild.Ivanti, via The Hacker NewsAttributed
Volexity said the first two flaws are an authentication bypass and remote code execution flaw tracked together as CVE-2026-104935.Volexity, via The Hacker NewsAttributed
Volexity said the first two flaws let an attacker run code as the appliance’s cgi-server user, while the third privilege escalation flaw raises access to root.Volexity, via The Hacker NewsAttributed
Ivanti released fixes for two flaws, while a fix for the privilege escalation flaw remains pending.Ivanti, via The Hacker NewsAttributed
Ivanti patched the vulnerabilities in Connect Secure versions 22.8R2.5, 25.1.1.2, 25.1.3.0, and 25.1.3.1.Ivanti, via SecurityWeekAttributed
The privilege escalation issue remains unpatched, and Ivanti plans to fix it over the coming weeks.Ivanti, via SecurityWeekAttributed
Volexity said the attacker stole domain credentials stored on the appliance and exfiltrated limited Active Directory metadata.Volexity, via SecurityWeekAttributed
Volexity said the attackers searched Active Directory for LAPS passwords and BitLocker recovery keys.Volexity, via SecurityWeekAttributed
Ivanti rates CVE-2026-104935 8.6 out of 10 on the CVSS severity scale.Ivanti, via The Hacker NewsAttributed
Volexity said the attackers ran password-spraying attacks and tested credentials with a custom Kerberos tool.Volexity, via SecurityWeekAttributed
Volexity found no backdoor or web shell on the device.Volexity, via SecurityWeekAttributed
Volexity said the operation was detected and disrupted before the attackers’ ultimate goals became clear.Volexity, via SecurityWeekAttributed
Volexity assessed with high confidence that the attackers’ actions pointed to preparation for lateral movement and a wider network compromise.Volexity, via SecurityWeekAttributed
Volexity assessed with medium confidence that UTA0576 uses large language models for exploit development and post-exploitation activity.Volexity, via SecurityWeekAttributed
Volexity assessed with low confidence that UTA0576’s motive is criminal rather than espionage.Volexity, via SecurityWeekAttributed
Ivanti warned customers on Tuesday that a zero-day vulnerability in its Connect Secure VPN appliances had been exploited in the wild.Ivanti, via SecurityWeekAttributed
Ivanti said exploitation affected a limited number of customers.Ivanti, via SecurityWeekAttributed
Volexity discovered exploitation while investigating an incident at one customer.Volexity, via SecurityWeekAttributed
Volexity tracks UTA0576 as a previously undocumented threat actor.Volexity, via SecurityWeekAttributed
Volexity found evidence of exploitation starting on October 3.Volexity, via SecurityWeekAttributed
Volexity said the attackers tried to extract credentials from captured network traffic.Volexity, via SecurityWeekAttributed
Volexity said the attackers scanned the network, collected appliance configuration data, and parsed authentication logs to identify valid usernames.Volexity, via SecurityWeekAttributed

Could not verify

  • How many customers were attacked is not established
  • Whether the third flaw has a temporary workaround is not established
  • Whether upgrading removes access an attacker has already gained is not established
cve
See all in Vulns & Patches →
Explore with AI
ChatGPT
Claude
Perplexity
Grok