Ivanti Connect Secure zero-days chained for unauthenticated root
Original title: Ivanti Connect Secure 0-Days Exploited in the Wild to Gain Unauthenticated Root Access
Fixes are 25.1.1.3 and 22.8R2.6 after UTA0576 hit a fully patched 22.8R2.4 appliance.
Attackers chained zero-days in Ivanti Connect Secure to get unauthenticated root, expose stored credentials, and query Active Directory. Ivanti confirmed attacks on a limited number of customers and released further fixes on October 29. Volexity ties the activity to UTA0576 from October 3, including a fully patched 22.8R2.4 appliance. The chain bypassed login, raced a temporary upload into code execution, then altered memory so a privileged service ran attacker code as root.
Unconfirmed: Ivanti says only a limited number of customers were attacked; broader victim scope is not stated.
- Tracked flaws are CVE-2026-104935 (CVSS 8.6), CVE-2026-111357 (CVSS 8.8), and CVE-2026-118527 (CVSS 4.3).
- Named fixes for those branches are 25.1.1.3 and 22.8R2.6.
- Stolen data included Windows LAPS passwords, BitLocker keys, and password attributes.
- No backdoor or web shell was left; commands were re-exploited over HTTPS.
- Ivanti’s Integrity Checker missed memory-only changes and restored settings.
Impact: Unauthenticated root and theft of stored domain credentials
| Product | Affected | Fixed in |
|---|---|---|
| Ivanti Connect Secure | 22.8R2.4 (Build 19097) was compromised while fully patched; other affected releases not fully listed | 25.1.1.3 and 22.8R2.6 |
- 1.Upgrade to 25.1.1.3 or 22.8R2.6 using Ivanti’s advisory for the appliance platform.
- 2.Look for unusual welcome.cgi traffic, mismatched paths and headers, and suspicious files in /tmp/.
- 3.If compromise is suspected, analyze memory, disk, and network, not only the integrity check.
- ATT&CK
- T1190 Exploit Public-Facing ApplicationT1068 Exploitation for Privilege EscalationT1110.003 Password SprayingT1040 Network SniffingT1070 Indicator Removal
- Vendors
- Ivanti
- Products
- Ivanti Connect Secure
- Threat actors
- UTA0576
- Organizations
- Volexity
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-104935 | Auth Bypass to Command Execution in Ivanti Connect Secure | 8.6 | 87% | KEVPoC ×4 | KEV |
| CVE-2026-111357 | Local root privilege escalation in Ivanti Connect Secure 22.8R2.4 | 7.0 | <1% | KEV | KEV |
| CVE-2026-118527 | Predictable identifiers in Ivanti Connect Secure enable file upload | — | — | KEV | — KEV |
From the original article
2 min read at cybersecuritynews.com
Attackers are chaining zero-day flaws in Ivanti Connect Secure VPN appliances to gain unauthenticated root access, exposing stored credentials and sensitive Active Directory data. Ivanti confirmed attacks against a limited number of customers and released additional fixes on October 29, 2026, following its initial October patches. Volexity tracked UTA0576 activity to October 3 and, during […]
By Abinaya · cybersecuritynews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.