Ivanti Connect Secure 0-days exploited to steal Active Directory credentials. October 14, 2026 Attackers chained three zero-day flaws in Ivanti Connect Secure VPN appliances to gain root-level access without logging in, then searched for credentials and sensitive Active Directory data. The activity, which began on October 3, 2026, targeted a fully patched appliance running version 22.8R2.4, showing that keeping a device current did not protect it from these previously unknown flaws. Discover more Cyber Security Newsletters Computer Security Software Security Awareness Training Volexity found the intrusion while investigating suspicious activity at a customer and worked with Ivanti to examine the affected device. The security firm tracks the previously unknown actor as UTA0576. Security Awareness Training Its analysis found attempts to steal domain credentials, Local Administrator Password Solution (LAPS) passwords, BitLocker recovery keys, and other directory information. Researcers at Volexity found that the chain combined an authentication bypass and a file-write weakness that Ivanti tracks together as CVE-2026-104935, followed by a separate privilege-escalation flaw. The first two issues let the attacker reach a protected script and run code as the appliance's cgi-server user. The third flaw then let UTA0576 run commands as root. Ivanti released a fix for CVE-2026-104935 on October 13, while the privilege-escalation issue remained under development for a future update. Ivanti Connect Secure 0-days exploited. Volexity said the initial bypass misused the appliance's handling of web requests. A request to a public login script could include an X-DSCGI-PATH header that directed the appliance to a different, protected script. The attacker then abused the file-upload handler to briefly place a script on the device. By sending repeated requests quickly, UTA0576 could run the file before the appliance deleted it. After gaining initial code execution, the actor used the privileged dsinvoked service to raise access to root. The exploit changed configuration data in memory, asked the service to run a task with an attacker-supplied script, and then restored the original settings. It also removed selected entries from Ivanti debug and Linux audit logs. Because the changes happened in memory and were reversed, Ivanti's Integrity Checker Tool might not show signs of compromise. The actor did not install a web shell or backdoor, according to Volexity. Instead, it sent commands through the same HTTPS exploit channel and received results in the responses. Discover more Cyber Attack Reports Threat Intelligence Platform Cybersecurity Author Services This made the activity harder to spot through a search for persistent malware alone. Organizations following the full Ivanti zero-day report should note that a clean file scan or the absence of a web shell cannot by itself rule out an intrusion. Once inside, UTA0576 used the VPN appliance's Active Directory service account to query a domain controller over LDAP. The searches included LAPS passwords, BitLocker recovery data, password-bearing account fields, logon script paths, and other user details. The actor also extracted credentials stored on the appliance, reviewed authentication logs for valid usernames, and tried password spraying against Active Directory accounts. The operation also included network discovery and data collection. A packet-capture tool searched traffic for LDAP credentials, HTTP Basic Authentication credentials, and NTLM challenge-response hashes. Lateral movement. The actor attempted to export captured traffic and directory results through the exploit channel. Volexity assessed with high confidence that the activity pointed to preparation for lateral movement, though the investigation did not establish the actor's ultimate goal. This focus on VPN appliances and directory credentials echoes other activity Volexity has investigated, including the SonicWall VPN credential theft campaign. The incidents involved different products and threat actors, but both show why edge devices can expose sensitive internal traffic. They should not be treated as the same campaign. Administrators should install the latest Ivanti update that applies to their appliance and investigate devices that may have been exposed. Volexity recommends watching for repeated requests to /dana-na/auth/url_default/welcome.cgi, especially when the X-DSCGI-PATH value points to a different location. Discover more Compare Security Exploit Database Access Teams should also check for unusual files and activity under /tmp/ and review network evidence. Suspected cases need memory and network forensics because log tampering and memory-only changes can hide traces from routine checks. Volexity published indicators related to the case, but its report does not provide file SHA values. The listed address and artifacts below come from the report; they are clues to investigate, not proof on their own that a device was compromised. Indicators of compromise (IoCs):- Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM. Update defenses against new malware as soon as it appears. Integrate TI Feeds with data from 16K SOCs. Tushar is a senior cybersecurity and breach reporter. He specializes in covering cybersecurity news, trends, and emerging threats, data breaches, and malware attacks. With years of experience, he brings clarity and depth to complex security topics. 0-Hour Cyber Security Alerts! Get the latest Cyber security News sent directly to your inbox. Discover more Ethical Hacking Tools Audit Security

Ivanti Connect Secure 0-days exploited to steal Active Directory credentials. Attackers chained three zero-day flaws in Ivanti Connect Secure VPN appliances to gain root-level access without logging in, then searched for credentials and sensitive Active Directory data. The activity, which began on October 3, 2026, targeted a fully patched appliance running version 22.8R2.4, showing that keeping a device current did not protect it from these previously unknown flaws. Volexity found the intrusion while investigating suspicious activity at a customer and worked with Ivanti to examine the affected device. The security firm tracks the previously unknown actor as UTA0576. Its analysis found attempts to steal domain credentials, Local Administrator Password Solution (LAPS) passwords, BitLocker recovery keys, and other directory information. Researcers at Volexity found that the chain combined an authentication bypass and a file-write weakness that Ivanti tracks together as CVE-2026-104935, followed by a separate privilege-escalation flaw. The first two issues let the attacker reach a protected script and run code as the appliance's cgi-server user. The third flaw then let UTA0576 run commands as root. Ivanti released a fix for CVE-2026-104935 on October 13, while the privilege-escalation issue remained under development for a future update. Ivanti Connect Secure 0-days exploited. Volexity said the initial bypass misused the appliance's handling of web requests. A request to a public login script could include an X-DSCGI-PATH header that directed the appliance to a different, protected script. The attacker then abused the file-upload handler to briefly place a script on the device. By sending repeated requests quickly, UTA0576 could run the file before the appliance deleted it. After gaining initial code execution, the actor used the privileged dsinvoked service to raise access to root. The exploit changed configuration data in memory, asked the service to run a task with an attacker-supplied script, and then restored the original settings. It also removed selected entries from Ivanti debug and Linux audit logs. Because the changes happened in memory and were reversed, Ivanti's Integrity Checker Tool might not show signs of compromise. The actor did not install a web shell or backdoor, according to Volexity. Instead, it sent commands through the same HTTPS exploit channel and received results in the responses. This made the activity harder to spot through a search for persistent malware alone. Organizations following the full Ivanti zero-day report should note that a clean file scan or the absence of a web shell cannot by itself rule out an intrusion. Once inside, UTA0576 used the VPN appliance's Active Directory service account to query a domain controller over LDAP. The searches included LAPS passwords, BitLocker recovery data, password-bearing account fields, logon script paths, and other user details. The actor also extracted credentials stored on the appliance, reviewed authentication logs for valid usernames, and tried password spraying against Active Directory accounts. The operation also included network discovery and data collection. A packet-capture tool searched traffic for LDAP credentials, HTTP Basic Authentication credentials, and NTLM challenge-response hashes. Lateral movement. The actor attempted to export captured traffic and directory results through the exploit channel. Volexity assessed with high confidence that the activity pointed to preparation for lateral movement, though the investigation did not establish the actor's ultimate goal. This focus on VPN appliances and directory credentials echoes other activity Volexity has investigated, including the SonicWall VPN credential theft campaign. The incidents involved different products and threat actors, but both show why edge devices can expose sensitive internal traffic. They should not be treated as the same campaign. Administrators should install the latest Ivanti update that applies to their appliance and investigate devices that may have been exposed. Volexity recommends watching for repeated requests to /dana-na/auth/url_default/welcome.cgi, especially when the X-DSCGI-PATH value points to a different location. Teams should also check for unusual files and activity under /tmp/ and review network evidence. Suspected cases need memory and network forensics because log tampering and memory-only changes can hide traces from routine checks. Volexity published indicators related to the case, but its report does not provide file SHA values. The listed address and artifacts below come from the report; they are clues to investigate, not proof on their own that a device was compromised. Indicators of compromise (IoCs):- Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM. Update defenses against new malware as soon as it appears. Integrate TI Feeds with data from 16K SOCs. The post Ivanti Connect Secure 0-days exploited to steal Active Directory credentials appeared first on cyber security News. Related cyber security News posts. A China-based attack group has launched a targeted campaign against Japanese shipping and transportation companies by exploiting critical vulnerabilities in Ivanti Connect Secure (ICS). The campaign, uncovered in April 2025, leverages two severe vulnerabilities to gain initial access to target networks and deploy multiple PlugX malware variants, including the newly... In "Cybersecurity News - Original News Source is cybersecuritynews.com" A newly discovered malware variant named RESURGE is actively targeting Ivanti Connect Secure devices by exploiting a critical zero-day vulnerability, prompting the U.S. Cybersecurity and Infrastructure Security Agency (CISA) to issue a formal warning. The malware is built to survive restarts, steal credentials, and hold its ground long after the... In "Cybersecurity News - Original News Source is cybersecuritynews.com"

CISA warns admins to immediately fix Ivanti flaw exploited as zero-day. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) urged security teams to immediately patch an Ivanti Connect Secure (ICS) flaw exploited in zero-day attacks since at least October 1st. Tracked as CVE-2026-104935, this high-severity authentication bypass vulnerability lets remote threat actors without privileges execute arbitrary commands on targeted ICS systems in low-complexity attacks that don't require user interaction. Ivanti released ICS versions 22.8R2.5, 25.1.3.0, 25.1.3.1, and 25.1.1.2 on Tuesday to address this security flaw and warned customers to "act immediately" because of "limited exploitation in the wild." While Ivanti didn't share additional information about ongoing attacks targeting CVE-2026-104935, cybersecurity firm Volexity reported that an unknown threat actor it tracks as UTA0576 has been chaining this security issue with two other flaws in attacks since at least October 3rd. "This exploit chain combined an authentication bypass, a remote code execution (RCE), and a privilege escalation vulnerability to achieve unauthenticated root-level code execution. The RCE and authentication bypass vulnerabilities are tracked under CVE-2026-104935," Volexity said. "Volexity identified a range of post-exploitation actions undertaken by the threat actor that targeted Active Directory credentials and secrets, including Local Administrator Password Solution (LAPS) passwords and BitLocker recovery keys." Threat intel firm Defused also confirmed Volexity's report, saying it first found evidence that attackers are abusing CVE-2026-104935 in the wild on October 1st. Internet threat watchdog Shadowserver now tracks over 5,600 Internet-exposed hosts with ICS fingerprints. However, there is no information on how many are secured against ongoing attacks or how many are honeypots designed to catch malicious activity. On Tuesday, CISA also added CVE-2026-104935 to its list of actively exploited security flaws and ordered federal agencies to secure their networks against attacks by Friday, as mandated by its June Binding Operational Directive 26-04. While BOD 26-04 applies only to Federal Civilian Executive Branch (FCEB) agencies, the cybersecurity agency also issued a separate advisory urging all security teams and network defenders to patch this vulnerability immediately and check for evidence of compromise. "CISA is aware of cyber threat actors exploiting this zero-day authentication bypass vulnerability, which allows remote, unauthenticated execution of arbitrary commands, to conduct credential theft and data exfiltration. [...] CISA urges organizations with affected Ivanti Connect Secure appliances and deployments to immediately update to the latest version," it warned. "Organizations seeking to determine whether they were compromised will need to conduct network and memory forensics to identify evidence of exploitation. [...] Ivanti's Integrity Checker Tool may not detect evidence of exploitation of CVE-2026-104935 because threat actor commands execute in memory." CISA advised defenders to take the following actions if they discover compromised Ivanti ICS appliances: Ivanti addressed multiple other Connect Secure zero-days exploited in the wild over the last several years, including an authentication bypass (CVE-2023-46805) and a command injection (CVE-2024-21887) in early January 2024, and a server-side request forgery (CVE-2024-21893) two weeks later. More recently, it patched a remote code execution (RCE) flaw (CVE-2025-0282) in January 2025 and another RCE vulnerability (CVE-2025-22457) that China-linked cyber spies have exploited since at least mid-March 2025. CISA has added 36 Ivanti vulnerabilities to its list of actively exploited security issues since November 2021, 12 of which have also been abused in ransomware attacks.