A fully patched enterprise VPN appliance was supposed to be safe. Attackers proved otherwise by chaining three previously unknown vulnerabilities in Ivanti Connect Secure to seize unauthenticated root access on devices running up-to-date software. Security firm Volexity says the campaign began on or around October 3, 2026, and attributes it to a previously undocumented threat actor it calls UTA0576. Ivanti has fixed two of the three flaws and is telling customers to act immediately.
A chain built for maximum damage
Connect Secure is an SSL VPN appliance widely used by businesses and government agencies to give remote employees access to internal networks. According to Volexity, UTA0576 combined three distinct bugs into a single exploit path that requires no credentials, no phishing, and no user interaction. The first two vulnerabilities, tracked jointly as CVE-2026-104935, pair an authentication bypass with a remote-code-execution flaw, together granting an attacker code execution as the appliance's low-privilege cgi-server process. A separate, third vulnerability then escalates that foothold to root, the account with unrestricted control over the device. Root access on a VPN gateway means an attacker can read credentials passing through it, alter its configuration, intercept traffic, and plant persistence that survives a reboot.
Stealth over convenience
What distinguishes this campaign from a typical appliance compromise is the absence of conventional malware. Volexity found no web shell and no dropped binary on compromised devices. Instead, UTA0576 re-exploited the chain for every command it wanted to run and tampered with logs along the way, a higher-effort approach that trades convenience for stealth and defeats file-based detection tools looking for a planted artefact. It also appears designed to undercut Integrity Checker Tools, the scanners vendors ship precisely because conventional antivirus and endpoint detection cannot reach into an appliance's own operating environment. Once inside, the group pursued a familiar playbook from an unusually privileged starting point: credential theft, reconnaissance of Active Directory environments, and data exfiltration.
A patch that only closes part of the door
Ivanti's advisory lists Connect Secure versions before 25.1.3.0 as affected, with 22.7R2.14 or earlier, 22.8R2.5, 25.1.3.0, and 25.1.3.1 cited as unaffected or fixed, alongside 25.1.1.2. The company has acknowledged limited exploitation in the wild. Crucially, Ivanti has patched the authentication-bypass and remote-code-execution pair but has not, per Volexity's reporting, shipped a fix for the privilege-escalation flaw that turns cgi-server access into root. An attacker can no longer walk through the front door on a patched system, but the backend escalation bug remained open at the time of this reporting, leaving organisations in an uncomfortable middle state.
The recurring cost of perimeter appliances
Ivanti's remote-access products have drawn repeated scrutiny over the past two years for chained authentication-bypass and command-injection bugs, and the company is not alone: Citrix NetScaler disclosed its own critical, actively exploited flaws this year. VPN gateways sit exposed to the internet by design, run complex management software outside the reach of standard endpoint tools, and hold privileged network access, a combination that makes them disproportionately attractive to well-resourced attackers willing to invest in zero-day research. Each incident like this one adds weight to arguments for zero-trust network access models that avoid granting remote clients a direct foothold at all.
- Identify every Connect Secure appliance and confirm its exact build number.
- Upgrade anything not already on 22.8R2.5, 25.1.1.2, 25.1.3.0, or 25.1.3.1 immediately.
- Run the Integrity Checker Tool, while treating it as unreliable alone given documented log tampering.
- Rotate credentials for every account that authenticated through the appliance since around October 3.
- Audit Active Directory for reconnaissance activity consistent with Volexity's findings.
- Treat any appliance running an affected build during that window as potentially compromised, not merely unpatched.