Ivanti Zero-Day Chain Gave Attackers Root Access to Fully Patched VPN

Ivanti has disclosed active exploitation of a high-severity zero-day, CVE-2026-104935, affecting its Connect Secure (ICS) VPN appliances, allowing unauthenticated remote attackers to run arbitrary commands by bypassing authentication. Security firm Volexity uncovered the attacks while responding to a customer incident, finding that a newly identified group it calls UTA0576 chained three separate zero-day flaws to obtain root-level, unauthenticated code execution on an appliance that was already fully patched. CVE-2026-104935 accounts for two of the three bugs — the authentication bypass and a remote code execution flaw — which Ivanti has now fixed in ICS releases 22.8R2.5, 25.1.1.2, 25.1.3.0, and 25.1.3.1, while a third privilege-escalation issue is still awaiting a patch expected in coming weeks. Volexity traced exploitation back to October 3 and observed the attackers stealing stored domain credentials, hunting for LAPS passwords and BitLocker keys in Active Directory, running password-spraying and Kerberos attacks, and tampering with logs, though no web shell or backdoor was found; the firm suspects the group — possibly aided by LLM tools — had criminal rather than espionage goals and was likely preparing for broader lateral movement before being stopped.