Ivanti VPN zero-day chain gave attackers root access

Three zero-day flaws in Ivanti Connect Secure were chained to gain unauthorised root access on a VPN appliance, with the attacker also stealing stored credentials, according to Volexity and The Hacker News.¹²

What happened

Volexity said it discovered the intrusion after investigating an Ivanti Connect Secure appliance that had been fully patched at the time. The threat actor, tracked as UTA0576, combined an authentication bypass, remote code execution and privilege escalation to run commands as root without logging in.¹

The first two flaws are tracked together as CVE-2026-104935. Ivanti's October security update says it is aware of limited exploitation in the wild and urges customers on affected versions to act immediately.³ Ivanti's advisory covers the affected versions and available fixes.⁴

The risk to customers

Volexity said the attacker extracted LDAP credentials and other Active Directory secrets, including LAPS passwords and BitLocker recovery keys. The operation also involved reconnaissance, password spraying and packet capture, while anti-forensic measures made Ivanti's Integrity Checker Tool less reliable for spotting the compromise.¹

The Hacker News reported that the three-flaw chain allowed commands to run as root and that only two of the vulnerabilities had been patched at the time of its report.² Ivanti recommends upgrading to a fixed version and running the Integrity Checker Tool regularly, while Volexity says organisations showing signs of compromise should carry out network and memory forensics.¹³

Our opinion

This is the sort of security incident that makes a routine patch notice much more serious. The danger is not just that an internet-facing appliance can be forced to run code; the chain turns that foothold into access to the credentials and recovery material that organisations rely on elsewhere.

Ivanti's advice to upgrade is the necessary first move, but it is not the whole response. Because the reported attacker worked in memory, erased evidence and used the appliance to move towards Active Directory, defenders need to treat a vulnerable or suspicious device as a possible incident rather than assuming a version change proves the network is clean.

What administrators should do

Ivanti says customers should review the security advisory, upgrade to a fixed version and run the Integrity Checker Tool regularly.³⁴ Volexity recommends forensic investigation where compromise indicators appear, including unusual requests to the VPN appliance and signs of credential abuse.¹

The background hero image is a Pexels photograph by panumas nikhomkhai, used as an abstract server visual rather than a picture of Ivanti hardware.⁵