Attackers chained three Ivanti zero-days to gain root on fully patched VPN appliances. H Help Net Security by Zeljka Zorz 14 Oct 2026, 16:59 PHT AI-written CyberNewsPH recap A threat actor chained three zero-day vulnerabilities in Ivanti Connect Secure VPN appliances to gain root access, execute arbitrary commands without authentication, and exfiltrate configuration data and credentials. Ivanti released patches for two of the flaws while a third fix remained pending, and CISA added the actively exploited vulnerability to its Known Exploited Vulnerabilities catalog. Headline and summary from Help Net Security, by Zeljka Zorz. CyberNewsPH links to the original rather than republishing it. Key facts. * Exploited CVE - CVE-2026-104935 * Vendor - Ivanti * Affected - Connect Secure * Patch - Available

Ivanti patches Connect Secure zero-day after researchers confirm in-the-wild attacks. Vendor promises fix for separate privilege-escalation flaw in the coming weeks Published Wed 14 Oct 2026 // 17:15 UTC Ivanti customers are being urged to update Connect Secure and check for compromise after attackers exploited a newly disclosed zero-day vulnerability. On Tuesday, Ivanti released updates for Connect Secure (ICS) to fix CVE-2026-104935, an authentication bypass flaw discovered by Volexity. Rated 8.6 on the CVSS scale, it allows remote, unauthenticated attackers to execute arbitrary commands. "We are aware of exploitation in the wild affecting a limited number of customers at the time of disclosure," the vendor said in its advisory. There are limited indicators of compromise available at present, it said, advising customers to refer to Volexity's report on the findings for more information, and to run the Ivanti Integrity Checker Tool regularly. Ivanti lists affected releases in the following branches: * 25.1.1.1 and earlier * 25.1.2.2 and earlier * 22.8R2.4 and earlier The vendor said it previously identified "a portion of this vulnerability" and patched it in July's 25.1.3.0 update, and had been working on backporting the same fix since then, however, attackers began exploiting it before that work was complete. Volexity said the attackers behind the recent intrusions were previously unknown to its researchers, but are now tracked as UTA0576. Criminal motive rather than espionage is suspected by Volexity. Based on observed post-exploitation activity, attackers appeared to be most interested in using their newfound access for credential theft, data exfiltration, log tampering, and network reconnaissance. Notably, the attackers did not deploy any malware nor execute web shells, using only the commands available to them on the ICS appliance. "Because the operation was detected and disrupted, the threat actor's ultimate objectives could not be determined," said Volexity. "However, Volexity assesses with high confidence that UTA0576's actions signaled preparation for lateral movement and a broader compromise of the victim network." The researchers also suspect that the attackers were using large language models to support their endeavors. Volexity pointed to the attackers' repeated use of the exploit channel to run commands, rather than deploying web shells, and their use of "highly specific scripts using hardcoded credentials." Ivanti disclosed one CVE, but Volexity described an attack chain involving three vulnerabilities. Tuesday's updates address the authentication bypass and remote code execution stages. The third vulnerability, which allows privilege escalation, is separate from the flaws encompassed by CVE-2026-104935. Volexity said Ivanti is aware of the additional bug and plans to publish a fix "in the coming weeks." The disclosure of the zero-day this week makes it the third year running that Ivanti has had to deal with attackers exploiting undisclosed flaws in Connect Secure. The previous ICS zero-days were disclosed in January 2025, a year after the January 2024 vulnerabilities led to exploits affecting thousands of ICS appliances. In the interim, Hypriot has also seen suspected Chinese espionage groups exploiting bugs in Endpoint Manager Mobile (EPMM), and critical flaws in Sentry. Ivanti's run of January zero-days continued earlier this year, although those flaws affected EPMM rather than Connect Secure.(R)

Ivanti Connect Secure 0-days exploited to steal Active Directory credentials. October 14, 2026 Attackers chained three zero-day flaws in Ivanti Connect Secure VPN appliances to gain root-level access without logging in, then searched for credentials and sensitive Active Directory data. The activity, which began on October 3, 2026, targeted a fully patched appliance running version 22.8R2.4, showing that keeping a device current did not protect it from these previously unknown flaws. Discover more Cyber Security Newsletters Computer Security Software Security Awareness Training Volexity found the intrusion while investigating suspicious activity at a customer and worked with Ivanti to examine the affected device. The security firm tracks the previously unknown actor as UTA0576. Security Awareness Training Its analysis found attempts to steal domain credentials, Local Administrator Password Solution (LAPS) passwords, BitLocker recovery keys, and other directory information. Researcers at Volexity found that the chain combined an authentication bypass and a file-write weakness that Ivanti tracks together as CVE-2026-104935, followed by a separate privilege-escalation flaw. The first two issues let the attacker reach a protected script and run code as the appliance's cgi-server user. The third flaw then let UTA0576 run commands as root. Ivanti released a fix for CVE-2026-104935 on October 13, while the privilege-escalation issue remained under development for a future update. Ivanti Connect Secure 0-days exploited. Volexity said the initial bypass misused the appliance's handling of web requests. A request to a public login script could include an X-DSCGI-PATH header that directed the appliance to a different, protected script. The attacker then abused the file-upload handler to briefly place a script on the device. By sending repeated requests quickly, UTA0576 could run the file before the appliance deleted it. After gaining initial code execution, the actor used the privileged dsinvoked service to raise access to root. The exploit changed configuration data in memory, asked the service to run a task with an attacker-supplied script, and then restored the original settings. It also removed selected entries from Ivanti debug and Linux audit logs. Because the changes happened in memory and were reversed, Ivanti's Integrity Checker Tool might not show signs of compromise. The actor did not install a web shell or backdoor, according to Volexity. Instead, it sent commands through the same HTTPS exploit channel and received results in the responses. Discover more Cyber Attack Reports Threat Intelligence Platform Cybersecurity Author Services This made the activity harder to spot through a search for persistent malware alone. Organizations following the full Ivanti zero-day report should note that a clean file scan or the absence of a web shell cannot by itself rule out an intrusion. Once inside, UTA0576 used the VPN appliance's Active Directory service account to query a domain controller over LDAP. The searches included LAPS passwords, BitLocker recovery data, password-bearing account fields, logon script paths, and other user details. The actor also extracted credentials stored on the appliance, reviewed authentication logs for valid usernames, and tried password spraying against Active Directory accounts. The operation also included network discovery and data collection. A packet-capture tool searched traffic for LDAP credentials, HTTP Basic Authentication credentials, and NTLM challenge-response hashes. Lateral movement. The actor attempted to export captured traffic and directory results through the exploit channel. Volexity assessed with high confidence that the activity pointed to preparation for lateral movement, though the investigation did not establish the actor's ultimate goal. This focus on VPN appliances and directory credentials echoes other activity Volexity has investigated, including the SonicWall VPN credential theft campaign. The incidents involved different products and threat actors, but both show why edge devices can expose sensitive internal traffic. They should not be treated as the same campaign. Administrators should install the latest Ivanti update that applies to their appliance and investigate devices that may have been exposed. Volexity recommends watching for repeated requests to /dana-na/auth/url_default/welcome.cgi, especially when the X-DSCGI-PATH value points to a different location. Discover more Compare Security Exploit Database Access Teams should also check for unusual files and activity under /tmp/ and review network evidence. Suspected cases need memory and network forensics because log tampering and memory-only changes can hide traces from routine checks. Volexity published indicators related to the case, but its report does not provide file SHA values. The listed address and artifacts below come from the report; they are clues to investigate, not proof on their own that a device was compromised. Indicators of compromise (IoCs):- Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM. Update defenses against new malware as soon as it appears. Integrate TI Feeds with data from 16K SOCs. Tushar is a senior cybersecurity and breach reporter. He specializes in covering cybersecurity news, trends, and emerging threats, data breaches, and malware attacks. With years of experience, he brings clarity and depth to complex security topics. 0-Hour Cyber Security Alerts! Get the latest Cyber security News sent directly to your inbox. Discover more Ethical Hacking Tools Audit Security