Attackers are chaining zero-day flaws in Ivanti Connect Secure VPN appliances to gain unauthenticated root access, exposing stored credentials and sensitive Active Directory data.

Ivanti confirmed attacks against a limited number of customers and released additional fixes on October 29, 2026, following its initial October patches.

Volexity tracked UTA0576 activity to October 3 and, during an October 5 investigation, identified a compromised, fully patched Ivanti appliance running version 22.8R2.4 (Build 19097) during an investigation on October 5, highlighting the flaws’ ability to bypass existing protections.

According to Volexity’s technical analysis, the attack began with an authentication bypass in welcome.cgi, the public login script. A mismatch between the requested URL and the X-DSCGI-PATH header let the attacker reach a protected upload handler without signing in.

The upload handler, wu.cgi, wrote incoming content to a predictable temporary location before checking whether it was a valid ZIP file. The attacker uploaded a Perl script and sent parallel requests to execute it before the appliance deleted it. This timing flaw delivered code execution as the appliance’s cgi-server user.

Ivanti Memory Analysis with Volexity Volcano (source : Volexity ) — Ivanti Memory Analysis with Volexity Volcano (source: Volexity )

The attacker then abused the privileged dsinvoked service. By changing library code in memory and altering a maintenance task in the DSCache configuration store, UTA0576 caused the service to run attacker-controlled code as root. The payload then restored the changed settings and memory to hide its activity.

Ivanti Connect Secure Zero-Days Exploited

Earlier CybersecurityNews coverage of the Ivanti authentication bypass (CVE-2026-104935) detailed the initial disclosure and affected releases.

Ivanti also tracks CVE-2026-104935 (CVSS 8.6) for authentication bypass and code execution, CVE-2026-111357 (CVSS 8.8) for privilege escalation, and CVE-2026-118527 (CVSS 4.3) for a predictable-filename weakness.

UTA0576 did not install a backdoor or web shell. Instead, it repeated the exploit chain for each command and received results through HTTPS responses. This reduced the need to leave persistent access tools on disk.

Pivoting from Hidden Directory Commands Alert (source : Volexity ) — Pivoting from Hidden Directory Commands Alert (source: Volexity )

After gaining control, the attacker extracted stored domain credentials and used the VPN appliance’s Active Directory service account to query internal systems. Targets included Windows LAPS administrator passwords, BitLocker recovery keys, and password-containing attributes.

The operation also involved password spraying, username collection, and packet analysis to recover credentials from network traffic. Related reporting on Active Directory credential theft details how the compromised gateway became a starting point for wider access. Volexity assessed that these actions prepared the attacker to move into other systems.

The October 29 update supplied for this report identifies 25.1.1.3 and 22.8R2.6 as releases resolving all disclosed vulnerabilities on those branches. Administrators should follow Ivanti’s advisory and select the correct upgrade for their appliance platform.

Exploit Tools and PCAP Files Recovered from Memory (source : Volexity ) — Exploit Tools and PCAP Files Recovered from Memory (source: Volexity )

Detection needs more than a clean integrity check. Volexity found that memory-only changes and restored settings escaped Ivanti’s Integrity Checker.

Defenders should examine unusual welcome.cgi traffic, mismatched request paths and headers, suspicious files in /tmp/, and connections from the VPN into internal systems.

Suspected compromises require memory, disk, and network analysis because the attacker also removed selected debug and audit log entries. A clean check alone cannot rule out this compromise.

Give your SOC the alert context to stops incidents quickly. Integrate Threat Intel from 16K SOCs.

The post Ivanti Connect Secure 0-Days Exploited in the Wild to Gain Unauthenticated Root Access appeared first on Cyber Security News.