Ivanti VPN: Chained Zero-Days Steal AD Secrets From Patched Gateways
Attackers chain three zero-day flaws to gain root access on patched Ivanti VPN gateways and steal Active Directory secrets.
Key points
- UTA0576 chains CVE-2026-104935 with two other flaws for unauthenticated root execution.
- Ivanti patches the auth bypass but has not fixed the privilege escalation flaw yet.
- Attackers target LAPS passwords and BitLocker keys without installing persistent malware.
Ivanti Connect Secure remote access gateways face active exploitation of a high-severity authentication bypass, tracked as CVE-2026-104935. According to BleepingComputer, Ivanti urged customers to patch immediately after confirming limited in-the-wild attacks. The flaw allows remote actors to execute arbitrary commands without credentials or user interaction. As SecOps Signal reported on 2026-10-13, similar spoofing flaws have previously enabled unauthenticated command execution on these devices.
The risk
Cybersecurity firm Volexity identified that threat actor UTA0576 has chained CVE-2026-104935 with two other vulnerabilities since at least October 3, 2026. This chain grants unauthenticated root-level code execution on fully patched appliances running version 22.8R2.4. The attacker misused web request handling to reach a protected script and used a file-upload handler to place a script temporarily. By sending rapid requests, the actor executed the file before the appliance deleted it, according to Cyber Security News.
Who is exposed
The authentication bypass affects Ivanti Connect Secure versions 22.8R2.4 and earlier, 25.1.2.2 and earlier, and 25.1.1.1 and earlier. Shadowserver tracks over 5,500 ICS instances exposed online, though the number of honeypots or secured devices is unknown. Volexity noted that UTA0576 targeted a fully patched device, proving that current updates did not protect against this specific chain. The actor did not install malware or web shells, making detection harder.
Cost and compliance
Volexity reported that UTA0576 searched for Active Directory credentials, Local Administrator Password Solution (LAPS) passwords, and BitLocker recovery keys. The threat actor tampered with logs to cover tracks and evaded Ivanti’s Integrity Checker Tool. Because the exploit changed configuration data in memory and then restored original settings, standard integrity checks might not show signs of compromise. Defused confirmed seeing exploitation signs starting October 1, according to BleepingComputer.
What to watch
Ivanti released fixes for CVE-2026-104935 on October 13, including versions 22.8R2.5, 25.1.3.0, 25.1.3.1, and 25.1.1.2. However, the privilege escalation vulnerability used in the chain remains under development for a future update. CISA urged security teams to patch immediately. That suggests organizations must monitor for unusual command execution even after applying the current authentication bypass fix.
Signals worth monitoring
Teams usually check for anomalous HTTP headers like X-DSCGI-PATH in web server logs, as these may indicate attempts to redirect requests to protected scripts. Look for rapid, repeated requests to upload endpoints that succeed briefly before files are deleted, which can signal transient script execution.
Monitor for unexpected privilege changes or service calls from the cgi-server user to the dsinvoked service, even if no persistent files are found. Check for gaps in audit logs or sudden restoration of configuration states in memory, which may indicate tampering. Verify that integrity checker tools are configured to detect runtime memory modifications, not just file system changes, to catch ephemeral exploits.
Background: Authentication bypass vulnerabilities
Authentication bypass vulnerabilities arise from logic flaws, improper session handling, and misconfigured permissions. These mistakes let attackers access data without valid credentials. Fixing them requires strict input validation, secure session management, and regular vulnerability scanning to identify weak points before exploitation.
Read the full guide: Authentication Bypass Mistakes That Leave Systems Exposed
What to do and how to stay safe: Ivanti Connect Secure
- Apply the latest Ivanti Connect Secure updates addressing CVE-2026-104935 immediately to block the initial authentication bypass.
- Monitor web server logs for unusual header values and rapid request patterns that could indicate transient script execution.
- Verify that integrity monitoring tools are configured to detect runtime memory changes and service anomalies, not just file modifications.
- Review Active Directory and LAPS access logs for unusual queries or credential retrieval attempts from VPN gateway IP addresses.
Step-by-step guide: Vulnerability Prioritization: Fix What Actually Matters First
General security guidance from the SecOps Signal newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Does the current Ivanti patch fix the entire exploit chain?
No, Ivanti has patched the authentication bypass CVE-2026-104935 but has not yet released a fix for the separate privilege escalation flaw used in the chain.
What specific data did attackers target in these incidents?
Attackers targeted Active Directory credentials, Local Administrator Password Solution (LAPS) passwords, and BitLocker recovery keys according to Volexity.
How did the attacker evade detection tools?
The attacker tampered with logs and exploited the device without installing malware, making it harder to detect through traditional malware scanning or static integrity checks.
