Attacker Chains Three Ivanti Connect Secure Zero-Days for Root Access — Only Two Are Patched
The exploit changes library code only in memory, restores what it touches, and reruns the whole chain for every command — leaving no backdoor behind.
Root on a fully patched appliance
Security firm Volexity reported on October 13 that an attacker it tracks as UTA0576 chained three zero-day flaws in Ivanti Connect Secure — a widely deployed VPN appliance — to run commands as root without ever logging in. The affected appliance was fully patched at the time, running version 22.8R2.4, and the attacker began exploiting it on October 3.
The first two flaws — an authentication bypass by spoofing and a remote code execution bug — are tracked together as CVE-2026-104935, which Ivanti rates 8.6 out of 10 on CVSS. Together they give the attacker code execution as the appliance's cgi-server user; the third flaw, a privilege escalation, then raises that to root. Ivanti has released fixes for two of the three, and told customers on affected versions to act immediately. A fix for the third is still pending, expected in a release in the coming weeks. Affected versions are listed as Connect Secure before 25.1.3.0, excluding 22.7R2.14 or prior.
Built to vanish
The exploit is designed to slip past Ivanti's own Integrity Checker Tool: it modifies library code only in memory and restores the configuration data it alters, with no backdoor or web shell left behind. The attacker also actively obscured its footprint, rerunning the entire exploit chain for each command. Confirming a compromise now requires full network and memory forensics — the integrity checker will simply report the appliance as clean.
- Mass requests to
/dana-na/auth/url_default/welcome.cgi X-DSCGI-PATHheader values that do not match the requested URL path- Presence of the
/data/.icscap/directory - Activity traced to host IP
108.165.147[.]64
That one incident told a clear story: the attacker stole stored credentials, including LDAP domain credentials, searched Active Directory for passwords, and ran password-spraying attacks — classic post-compromise reconnaissance for lateral movement. Neither Ivanti nor Volexity said how many customers were hit, and the post names no temporary workaround for customers who cannot upgrade yet. Separately, the same Ivanti advisory covers two 9.9-rated flaws in Xtraction (CVE-2026-106042) and Neurons Patch for Intune (CVE-2026-109412) not observed in the wild, and CISA's entry marks CVE-2026-104935 exploitation as active with total technical impact.
What this means for you
If you run Ivanti Connect Secure, upgrade to the patched release, run the Integrity Checker Tool, and — critically — assume the tool alone is not enough. Audit for the four forensic indicators above and preserve network and memory evidence, because a compromised appliance can look completely clean.
Sources: The Hacker News — Attacker Chains Three Ivanti Connect Secure Zero-Days; CISA — Known Exploited Vulnerabilities Catalog (CVE-2026-104935).
Corrections: Report an error at corrections@wireshaman.com.