Security researchers have caught an attacker chaining three separate flaws in Ivanti Connect Secure, a VPN appliance used by businesses and government agencies to let staff connect remotely to internal networks, to get full root access on devices that were already fully patched and up to date.
The firm that found the activity, Volexity, says the intrusion began on October 3, 2026, against one customer’s appliance running Connect Secure version 22.8R2.4, which at the time carried every available security update. Instead of relying on a single bug, the attacker strung together three flaws in sequence: two gave the ability to run commands as a low-privilege service account called cgi-server, and a third, a privilege escalation bug that still has no public fix, lifted that access all the way to root, the highest level of control on the device.
Volexity is tracking the group behind the activity as UTA0576. Rather than installing a backdoor or a web shell that defenders might later find sitting on disk, the attacker reran the entire three-step exploit chain every time it wanted to execute a new command, then cleaned up its traces afterward. Because the tampering happened only in the device’s running memory, and because the group restored the configuration data it had altered, Ivanti’s own Integrity Checker Tool, the utility administrators are told to run to verify a device has not been compromised, did not catch it.
Once inside, the attacker reportedly stole credentials stored on the appliance, including domain credentials used to connect to the customer’s Active Directory, searched that directory for additional passwords, and ran password-spraying attempts against other accounts. Volexity said it assesses with low confidence that the motive was financial rather than espionage, though it did not rule out either possibility.
The lead vulnerability in the chain, CVE-2026-104935, is an authentication bypass that Ivanti rates 8.6 out of 10 in severity. It lets a remote attacker with no valid login run commands on the device without needing any user interaction. The CVE record for the flaw, maintained with CISA’s involvement, currently marks exploitation as active and its technical impact as total. Ivanti has shipped fixes for two of the three chained bugs; the privilege escalation flaw that completes the chain is still unpatched, and Ivanti says a fix is coming in a future release in the weeks ahead. Devices running Connect Secure 22.8R2.5, 25.1.3.0, or 25.1.3.1 are not affected by the patched portion of the chain; everything on earlier versions is.
Independent monitoring from the security research group Defused corroborated Volexity’s findings and traced the earliest signs of exploitation back to October 1, two days before Volexity’s own detection. Separately, the internet-scanning service Shadowserver has counted more than 5,500 Connect Secure devices reachable from the open internet, though it is unclear how many of those are decoy honeypots or have already been secured.
Ivanti said in a statement that it is aware of limited exploitation in the wild and is working directly with affected customers. The company is urging every customer still on an affected version to treat the update as urgent: apply the patch, then run the Integrity Checker Tool on a recurring basis rather than as a one-time check. Because the tool missed this particular attack chain, Volexity’s advice to administrators is to also review appliance logs and network traffic directly rather than relying on the checker alone.
This is far from the first time Ivanti’s remote-access products have been targeted. CISA has listed 36 separate Ivanti vulnerabilities as actively exploited in its Known Exploited Vulnerabilities catalog since November 2021, and ransomware groups are known to have abused at least 12 of those. Previous Connect Secure flaws exploited at scale include an authentication bypass and command injection pair patched in early January 2024, a server-side request forgery bug patched weeks later, a remote code execution flaw patched in January 2025, and another remote code execution bug that China-linked espionage actors exploited starting in mid-March 2025.
No CVE number has yet been assigned to the privilege escalation flaw as of publication, and neither Volexity nor Ivanti has said how many customer organizations, beyond the one case under investigation, may have been affected.
Source: The Hacker News, with additional reporting from BleepingComputer.
