Ivanti Connect Secure Zero-Days Let Attackers Reach Root on VPN Appliances

Volexity says a chained exploit against Ivanti Connect Secure, the VPN appliance many organizations place on the edge of their networks, can reach root on fully patched systems without a login. Ivanti has already released fixes for two of the three flaws in the chain and says it is aware of “limited exploitation in the wild,” but a separate privilege-escalation bug is still awaiting a future release.

What Volexity found

In a report published on October 13, Volexity said it identified active in-the-wild exploitation of a vulnerability chain affecting Ivanti Connect Secure. The firm said an unknown threat actor, which it tracks as UTA0576, compromised a fully patched appliance running version 22.8R2.4 and began exploiting it on October 3. Volexity said the chain combined an authentication bypass, a remote code execution flaw and a privilege-escalation bug to achieve unauthenticated root-level code execution.

The first two flaws are tracked together as CVE-2026-104935. According to Volexity, the attacker used them to run code as the appliance’s cgi-server user, then chained the third flaw to obtain root privileges. The report says the commands were executed over the exploit channel itself, with no web shell or backdoor left behind. That makes the incident especially awkward for defenders, because there may be little on disk to tip off a quick scan.

Why VPN appliances are such valuable targets

VPN gateways sit at the edge of the network, but they often know far more about the inside of the network than outside attackers should. They terminate sessions, hold authentication state and sometimes expose credentials or tokens that can be reused elsewhere. In this case, Volexity said the attacker stole stored credentials, searched Active Directory for passwords and ran password-spraying attacks against accounts after gaining access.

That sequence matters because a compromise at the VPN layer can become a pivot point into the rest of the environment. If an attacker controls the appliance, the goal is often not just remote code execution. It can also be credential theft, lateral movement and quieter persistence against systems that trust the gateway.

What Ivanti says to do now

Volexity said Ivanti has fixed the authentication-bypass and remote code execution components, and Ivanti’s security advisory tells customers on affected versions to act immediately. Volexity also said Ivanti is still working on a fix for the privilege-escalation flaw, which it expects in a future release. In the same report, Volexity warned that Ivanti’s Integrity Checker Tool will not catch this chain because the exploit modifies library code only in memory and then restores the configuration data it touched.

The Hacker News likewise reported that Ivanti said it is aware of “limited exploitation in the wild,” and that the CVE entry and CISA mark exploitation as active. Even if you have already patched, Volexity’s forensic guidance suggests the incident may still warrant deeper investigation, especially if there are signs of strange authentication activity, lateral movement or password spraying originating from the appliance.

What security teams should watch for next

For VPN and security teams, the immediate lesson is not to treat patching as the whole story. A fully patched appliance was compromised here, and the attacker’s behavior was designed to leave little behind on disk. If your organization runs Connect Secure, this is a good moment to review log retention, collect memory and disk images where warranted, and check for any unusual outbound connections or account activity that followed VPN logins.

Just as important, the report is a reminder that perimeter devices are not passive plumbing. They are high-trust systems with direct access to the inner network, and attackers know it. When a VPN appliance is the first thing they can reach, it can also become the first thing they own.

Editorial analysis

The story is bigger than one appliance line. It shows how quickly a remote-access device can flip from convenience to crisis when an exploit chain reaches root on the edge. For readers, the practical takeaway is clear: patch aggressively, assume exposed gateways are high-value targets, and treat strange authentication or lateral movement from a VPN box as a possible incident, not just a noise event.

It also shows why post-breach forensics matter. If an attack chain is built to live in memory and reuse the exploit path for each command, there may be no obvious web shell to find. In other words, the absence of a visible implant is not proof the appliance stayed clean.

Sources: Volexity report; The Hacker News coverage; Ivanti security advisory.