Attackers chained three Ivanti zero-days to gain root on fully patched VPN appliances

Security researchers at Volexity have uncovered a threat actor tracked as UTA0576 abusing three previously unknown flaws in Ivanti Connect Secure to breach a fully patched VPN appliance (version 22.8R2.4). By chaining an authentication bypass in welcome.cgi, a file-write bug in wu.cgi, and a privilege-escalation issue in how the dsinvoked broker trusts DSCache data, the attacker obtained root-level command execution. This allowed theft of stored credentials, Active Directory metadata, local admin passwords, BitLocker keys, LDAP traffic, and configuration files, along with log tampering to erase traces of the intrusion. Ivanti has shipped a fix for the authentication-bypass/RCE issue under CVE-2026-104935 and is still developing a patch for the privilege-escalation component; CISA has added the flaw to its Known Exploited Vulnerabilities list and given federal agencies until October 16, 2026 to remediate and investigate, while Volexity warns that the standard Integrity Checker Tool may fail to detect this particular compromise.