A Series of Unauthenticated Events: Chained Exploitation of Ivanti Connect Secure Zero-Days
Summary: Volexity discovered threat actor UTA0576 exploiting a zero-day chain in a fully patched Ivanti Connect Secure VPN appliance (version 22.8R2.4) starting October 3, 2026, combining an authentication bypass, remote code execution, and privilege escalation to gain unauthenticated root access. The actor deleted debug and Linux audit logs, ran commands through the exploit chain's HTTPS requests rather than a separate C2 channel, and targeted Active Directory credentials, LAPS passwords, and BitLocker recovery keys.
Key Takeaway: Ivanti's Integrity Checker Tool cannot detect this chain because it patches library code in memory only and restores configuration data, so a fully patched appliance can be compromised and leave no on-disk trace for standard checks to find.
Read the original at Volexity Blog ↗
- Topics
- Vulnerabilities & Patching
- Mentions
- CVE-2026-104935CVE-2026-111357
- Related
- CISA Adds Two Known Exploited Vulnerabilities to Catalog Cyber Risks · Oct 30, 2026CVE-2026-111357: Ivanti Connect Secure Missing Authentication for Critical Function Vulnerability Known Exploited Vulnerabilities · Oct 30, 2026CVE-2026-104935: Ivanti Connect Secure Authentication Bypass by Spoofing Vulnerability Known Exploited Vulnerabilities · Oct 13, 2026