Attackers Chained Three Ivanti VPN Zero-Days to Seize Root Access on Fully Patched Gateways

Someone has been walking into Ivanti VPN gateways as root, without a password, on machines that were fully up to date. The attackers chained three previously unknown flaws in Ivanti Connect Secure and left almost nothing behind.

Security firm Volexity disclosed the campaign on October 13. It attributes the activity to a threat actor it tracks as UTA0576, a label for a group it has not tied to any known name.

The target appliance was running version 22.8R2.4, Build 19097, the latest release at the time. That did not matter.

Three bugs, one root shell

The chain stacks an authentication bypass, a remote code execution flaw, and a privilege escalation. Together they give an attacker with no credentials root-level code execution on the gateway that is supposed to keep them out.

Exploitation started on or around October 3, according to Volexity, with signs of activity going back to October 1.

Ivanti has fixed only part of the problem. The authentication bypass and the code execution bug are tracked together as CVE-2026-104935 and were patched in releases on October 13. The privilege escalation is still being worked on for a future release. Rapid7 rates the disclosed CVE at 8.6 on CVSSv3.

No malware, no web shell

What makes UTA0576 unusual is restraint. The attackers deployed no malware and no web shell. Instead they re-exploited the device for every command they wanted to run, which means there was no persistent implant sitting on disk for defenders to find.

They also tampered with logs to slip past Ivanti's Integrity Checker Tool, the utility customers are told to run when they suspect a compromise. CISA warned on the same day that the checker may miss in-memory exploitation, and added CVE-2026-104935 to its Known Exploited Vulnerabilities catalog.

That combination is a nightmare for incident response. A clean integrity scan on an Ivanti box is no longer proof of much.

A VPN gateway sits in front of everything else a company runs, so root on that box is a very strong foothold.

Who is exposed

Ivanti says it is aware of limited exploitation in the wild. Affected versions include 22.8R2.4 and earlier, 25.1.2.2 and earlier, and 25.1.1.1 and earlier, per BleepingComputer. Fixed builds include 22.8R2.5, 25.1.3.0 and 25.1.3.1, and 25.1.1.2, depending on the code line.

Shadowserver tracks more than 5,500 Connect Secure instances exposed to the internet. It cannot say how many are honeypots or already patched.

Ivanti is telling customers to upgrade immediately and to run the Integrity Checker regularly, even with its blind spots.

A familiar pattern

None of this is new territory for Ivanti. Its VPN products have been hit by zero-days repeatedly in past years, and CISA has flagged dozens of Ivanti CVEs as exploited since 2021.

Remote root bugs keep surfacing in software companies trust with deep access to their machines, from the public AnyDesk Linux root exploit to Ivanti's own gateways.

For now, admins have two of three holes closed and a third still open, on a box where the attackers were careful to leave no fingerprints.

Some offers on this page may be paid placements or contain affiliate links.