Attacker Chains Three Ivanti Connect Secure Zero-Days for Root Access, Only Two Patched So Far

Volexity disclosed that a threat actor it tracks as UTA0576 strung together three previously unknown vulnerabilities in Ivanti's Connect Secure VPN appliance to gain unauthenticated root access, bypassing the device's Integrity Checker Tool by patching library code only in memory. The first two bugs — an authentication bypass combined with a remote-code-execution issue, tracked jointly as CVE-2026-104935 and rated 8.6 by Ivanti — let the attacker execute commands as the cgi-server user on a fully patched appliance running version 22.8R2.4; a third, unpatched privilege-escalation flaw was then used to reach root. Ivanti has fixed the first two issues in version 25.1.3.0 and above, confirms active in-the-wild exploitation, and says a fix for the escalation bug is still weeks away, while CISA labels the exploitation status as active with total technical impact. The attacker stole LDAP credentials, scraped Active Directory for passwords, and password-sprayed accounts without dropping any backdoor, re-running the full exploit chain for every command; the same advisory also patches unrelated, unexploited critical flaws (CVSS 9.9) in Ivanti Xtraction and Neurons Patch for Intune.