Ivanti VPN Zero-Days Gave Hackers Root Access

Ivanti warned customers Tuesday that hackers exploited a high-severity authentication-bypass vulnerability in its Connect Secure VPN appliances. Tracked as CVE-2026-104935, the flaw lets a remote attacker without valid credentials run commands on an affected device.

Ivanti reported exploitation affecting a limited number of customers. Volexity discovered the activity while investigating an incident at one of its customers and linked it to an undocumented threat actor that it tracks as UTA0576.

Volexity found that the attackers chained three zero-day vulnerabilities to obtain unauthenticated, root-level code execution on a fully patched Connect Secure appliance. CVE-2026-104935 covers two of the flaws: an authentication bypass and a remote-code-execution vulnerability.

Ivanti patched those two vulnerabilities in Connect Secure versions 22.8R2.5, 25.1.1.2, 25.1.3.0 and 25.1.3.1. The third flaw, which allows privilege escalation, remains unpatched. Ivanti plans to release a fix for it in the coming weeks.

Volexity found evidence that the attacks began Oct. 3. UTA0576 focused on stealing credentials, collecting data, examining the victim’s network and altering logs to conceal its activity.

The attackers stole domain credentials stored on the VPN appliance and extracted a limited amount of Active Directory metadata. A custom tool searched Active Directory for Local Administrator Password Solution passwords and BitLocker recovery keys. The attackers also carried out password-spraying attempts, tested credentials with a custom Kerberos tool and tried to recover credentials from captured network traffic.

The activity included network scanning, collection of the appliance’s configuration and analysis of authentication logs to identify valid usernames. Volexity found no backdoor or web shell on the device.

The operation was detected and disrupted before the attackers’ final objectives were established. Volexity assessed with high confidence that the activity was preparation for lateral movement and a wider compromise of the victim’s network.

“Volexity assesses with low confidence that UTA0576 has criminal, rather than espionage, motivations based on the target of this activity,” the company wrote. It added that, with medium confidence, it believes the group uses large language models for exploit development and activity after gaining access to systems.