CVE-2026-104935: Ivanti Connect Secure Zero-Day Gives Attackers Root Access on Fully Patched VPNs

CVE-2026-104935 exploits three separate weaknesses in sequence, all executed without credentials. The first is the authentication bypass itself, classified as CWE-290. Ivanti Connect Secure authenticates users through a web gateway before granting access to the internal network. The bypass flaw lets a remote attacker craft an HTTP request that the gateway accepts as pre-authenticated, skipping credential validation entirely. The attacker needs only network access to the Connect Secure appliance's external interface: no username, no password, and no prior foothold inside the organization.

The second flaw in the chain accepts arbitrary file content written to the appliance's filesystem. Because the first step grants access as if from an authenticated session, the attacker can invoke internal file-handling functions that would otherwise require authentication. This step does not by itself produce code execution, but it places attacker-controlled content on the device in directories the application will later reference.

The third flaw is a local privilege escalation that converts file write access into root shell execution. An attacker who can write files to specific directories can trigger execution of that content with root privileges. This is the component that has no patch yet. Ivanti's October 13 release fixes the authentication bypass and the file write flaw. The privilege escalation component will ship in a subsequent release.

Volexity confirmed that UTA0576 left no persistent web shell between sessions. The attacker re-ran the full three-step chain on each visit, eliminating the file-based detection window that traditional web shell hunting relies on. The actor also modified the access logs that Ivanti's Integrity Checker Tool reads, meaning a clean result from that tool cannot be treated as evidence of no compromise on any appliance that was internet-facing during the October 3 to October 13 window.

UTA0576 is a previously unknown threat actor identified by Volexity during the investigation of CVE-2026-104935 exploitation. Volexity's "UTA" designation indicates unattributed actor status, meaning no confirmed nation-state or criminal group affiliation has been publicly announced as of October 13, 2026. The techniques observed demonstrate deliberate focus on anti-forensic tradecraft rather than opportunistic mass exploitation.

The actor exploited Connect Secure appliances from October 3 to October 7, 2026, targeting at least one confirmed organization. The primary objective was credential theft from Active Directory, which suggests either espionage intent or preparation for a follow-on ransomware or extortion campaign. Active Directory credentials provide broad lateral movement capability across a corporate network, making them a high-value target for both nation-state and criminal actors.

Three techniques distinguish UTA0576 from typical opportunistic attackers. First, the group re-exploited the authentication bypass for every command session rather than deploying a persistent web shell, a deliberate choice to avoid file-based detection. Second, they specifically tampered with the Connect Secure access logs that feed Ivanti's Integrity Checker Tool, demonstrating familiarity with Ivanti's forensic validation process. Third, the actor operated for five days before Volexity was engaged by the victim, indicating the initial compromise was silent enough to avoid triggering standard monitoring alerts.

No overlap with previously tracked groups has been confirmed. Organizations should not assume that only a single victim was targeted. The exploit chain was functional for at least 10 days before any patch existed, and any organization running a vulnerable Connect Secure version during that window should conduct compromise hunting regardless of what their monitoring showed.

Any organization with an internet-facing Ivanti Connect Secure appliance running a vulnerable firmware version is at risk. The affected version branches are: 25.1.1.1 and earlier, 25.1.2.2 and earlier, and 22.8R2.4 and earlier. The October 13 patches upgrade these to 25.1.1.2, 25.1.3.0 or 25.1.3.1, and 22.8R2.5 respectively. Connect Secure is widely deployed in enterprise, government, healthcare, and critical infrastructure environments as the primary SSL VPN gateway for remote workforce access.

Versions 22.7.x and below are reported to be unaffected by this specific chain. Ivanti strongly advises anyone still on 22.7.x to upgrade to 25.1.1.2 rather than treating unaffected status as a permanent condition.

Two risk factors elevate this beyond a standard CVE remediation. First, the partial patch means that even organizations that apply the October 13 release immediately are not fully protected against all three components. The privilege escalation step remains exploitable until Ivanti ships the follow-on patch. Patching reduces attack surface significantly but does not achieve full remediation until that third fix ships. Second, the attacker's anti-forensic techniques mean that a clean result from Ivanti's Integrity Checker Tool cannot rule out prior compromise. Any appliance that was internet-facing on the 25.1.1.1 or 22.8R2.4 firmware between October 3 and October 13 should be investigated for credential access and log tampering, not just patched.

This zero-day sits alongside the active FortiBleed campaign targeting Fortinet firewalls and the recent AhsayCBS auth-bypass-to-RCE chain as part of a sustained attacker focus on internet-facing enterprise perimeter appliances throughout October 2026. VPN infrastructure is the highest-value target in this threat cycle.

Volexity published indicators of compromise in their October 13 technical write-up. Because UTA0576 deployed no persistent web shell, traditional file-based IOC scanning may return clean results even on compromised appliances. Focus detection on HTTP access logs for the authentication bypass phase, and on Active Directory audit logs for downstream credential misuse.

Behavioral indicators are the most reliable signal for CVE-2026-104935 exploitation. Anomalous POST requests to Connect Secure authentication endpoints from external IP space, specifically requests that receive a successful HTTP 200 response without any prior session cookie, are the primary exploitation indicator. Inspect access logs for sequential requests that progress from the authentication endpoint directly to file-handling or administrative interface paths without a valid session token in the request headers.

UTA0576 specifically targeted log files to cover their tracks. If access logs show a gap (time periods where HTTP requests would be expected but no log entries appear), treat the appliance as compromised and initiate an emergency response. The CISA advisory recommends immediate patching followed by a factory reset and fresh credential provisioning when any evidence of log tampering is found.

The Active Directory environment that the Connect Secure appliance authenticates against is the critical downstream concern. UTA0576's confirmed objective was AD credential collection. Hunt for lateral movement from VPN-originated IP space, unexpected account privilege changes, and Kerberoasting activity originating from hosts that first appeared in authentication logs during the October 3 to October 13 exposure window.

Two detection rules cover the network-visible exploitation phases of CVE-2026-104935. The first targets the authentication bypass HTTP pattern at the Connect Secure gateway; the second targets the log tampering behavior UTA0576 used to evade forensic review. Both carry experimental status; validate against your environment's log format before enabling automatic blocking.

Patching is mandatory but not sufficient on its own. Apply the firmware update immediately, then perform a targeted investigation for compromise covering the October 3 to October 13 exploitation window. Do not rely on Ivanti's Integrity Checker Tool alone: UTA0576 specifically tampered with the log files the tool uses for validation, meaning a clean tool result cannot rule out prior exploitation.

After patching, initiate a parallel Active Directory investigation. UTA0576's confirmed goal was AD credential collection. Hunt for authentication events and Kerberoasting activity originating from VPN-sourced IP space during the exposure window, and treat any positive findings as requiring a full credential rotation.