Aviatrix Threat Research Center: Ivanti Connect Secure Zero-Days CVE-2026-104935

In October 2026, threat actor UTA0576 exploited a chain of three zero-day vulnerabilities in Ivanti Connect Secure VPN appliances to achieve unauthenticated root access. The attack targeted fully patched systems running version 22.8R2.4, combining authentication bypass and remote code execution flaws (CVE-2026-104935) with an unpatched privilege escalation vulnerability. The attacker stole LDAP credentials, performed Active Directory reconnaissance, and executed password-spraying attacks while evading detection through memory-only modifications and configuration restoration techniques.

This incident highlights the continued targeting of VPN infrastructure by sophisticated threat actors, reflecting the ongoing trend of chaining zero-day exploits against critical network access points. With only two of the three vulnerabilities patched and active exploitation confirmed by CISA, organizations face immediate risk to their remote access infrastructure.

VPN appliances remain prime targets for initial access, and this incident demonstrates how attackers are chaining multiple zero-days to bypass enterprise security controls. With one vulnerability still unpatched and active exploitation confirmed, organizations must immediately assess their Ivanti Connect Secure deployments.

UTA0576 exploited three chained zero-day vulnerabilities in Ivanti Connect Secure VPN appliances to achieve unauthenticated root access. The attack began with authentication bypass and remote code execution flaws (CVE-2026-104935) allowing initial system compromise, followed by privilege escalation to root level. The attacker then performed lateral movement into the corporate network by stealing LDAP credentials and conducting Active Directory reconnaissance. Command and control was established through repeated exploit chain execution for persistent access. Credential harvesting and password spraying attacks enabled widespread network access for data exfiltration. The attack resulted in complete compromise of domain credentials and potential unauthorized access to sensitive organizational resources.

Kill Chain Progression

This analysis maps confirmed threat intelligence to the full cloud kill chain to show where defensive gaps would emerge as an attack progresses.

Attacker exploited authentication bypass vulnerability in Ivanti Connect Secure VPN appliance via malicious requests to /dana-na/auth/url_default/welcome.cgi with crafted X-DSCGI-PATH headers

Included CVEs with severity scores, affected products, exploit status, and reference links.

CVE-2026-104935 CVSS 8.6 An authentication bypass and remote code execution vulnerability in Ivanti Connect Secure allows unauthenticated attackers to execute arbitrary code as the cgi-server user. Affected Products: Ivanti Connect Secure – before 25.1.3.0, 22.8R2.4 and earlier (excluding 22.7R2.14 or prior) Exploit Status: exploited in the wild References:

An authentication bypass and remote code execution vulnerability in Ivanti Connect Secure allows unauthenticated attackers to execute arbitrary code as the cgi-server user.

Ivanti Connect Secure – before 25.1.3.0, 22.8R2.4 and earlier (excluding 22.7R2.14 or prior)

CVE-2026-106042 CVSS 9.9 A critical vulnerability in Ivanti Xtraction allows remote code execution with high impact on confidentiality, integrity, and availability. Affected Products: Ivanti Xtraction – before 2026.4 Exploit Status: no public exploit References:

A critical vulnerability in Ivanti Xtraction allows remote code execution with high impact on confidentiality, integrity, and availability.

Ivanti Xtraction – before 2026.4

CVE-2026-109412 CVSS 9.9 A critical vulnerability in Ivanti Neurons Patch for Intune allows remote code execution with severe impact across confidentiality, integrity, and availability. Affected Products: Ivanti Neurons Patch for Intune – unspecified versions Exploit Status: no public exploit References:

A critical vulnerability in Ivanti Neurons Patch for Intune allows remote code execution with severe impact across confidentiality, integrity, and availability.

Ivanti Neurons Patch for Intune – unspecified versions

MITRE ATT&CK® Techniques

Exploit Public-Facing Application

Exploitation for Privilege Escalation

Use Alternate Authentication Material: Application Access Token

Valid Accounts: Cloud Accounts

Brute Force: Password Spraying

Account Discovery: Domain Account

Credentials from Password Stores: Credentials from Web Browsers

Indicator Removal on Host: File Deletion

Potential Compliance Exposure

Mapping incident impact across multiple compliance frameworks.

PCI DSS 4.0 – Software engineering techniques for secure development

Zero-day vulnerabilities in authentication bypass and privilege escalation demonstrate insufficient secure coding practices and vulnerability management in network segmentation components

NYDFS 23 NYCRR 500 – Penetration Testing

Chained zero-day exploits achieving root access without detection indicates inadequate penetration testing and vulnerability assessment coverage of critical network infrastructure

DORA – ICT risk management framework

Control ID: Article 11

Exploitation of VPN appliances protecting critical systems demonstrates gaps in third-party ICT risk management and supplier security oversight requirements

CISA ZTMM 2.0 – Application Workload Security

Control ID: Function 4

Authentication bypass and privilege escalation in network access control systems violates zero trust principles requiring continuous verification and least privilege access

NIS2 Directive – Cybersecurity risk management measures

Control ID: Article 21.2(a)

Successful exploitation of network security infrastructure through unpatched vulnerabilities indicates insufficient cybersecurity risk management and incident response capabilities

ISO 27001 – Management of technical vulnerabilities

Zero-day exploitation chain demonstrates inadequate vulnerability management processes and security monitoring controls for critical network infrastructure components

Industry-specific impact of the vulnerabilities, including operational, regulatory, and cloud security risks.

Critical exposure through VPN infrastructure compromise enabling Advanced Persistent Threat actors to steal LDAP credentials and conduct lateral movement attacks.

High-risk zero-day exploitation of Connect Secure VPN appliances threatens encrypted traffic security and enables privilege escalation for credential theft.

APT attacks via Ivanti Connect Secure vulnerabilities compromise HIPAA compliance requirements and enable unauthorized access to protected health information.

Zero-day chain exploitation demonstrates advanced east-west traffic security bypass techniques requiring immediate threat detection and anomaly response capabilities.

Attacker Chains Three Ivanti Connect Secure Zero-Days for Root Access, Only Two Patched So Far Verified

A Series of Unauthenticated Events: Chained Exploitation of Ivanti Connect Secure Zero-Days Verified

October 2026 Security Update - Ivanti Verified

Security Advisory: Ivanti Connect Secure CVE-2026-104935 Verified

CVE-2026-104935 Detail Verified

Frequently Asked Questions

Cloud Native Security Fabric Mitigations and Controls CNSF

Based on the attack progression modeled above, these are the defensive controls that would constrain each stage.

Aviatrix Zero Trust CNSF would have constrained this VPN appliance compromise by limiting the attacker's ability to move laterally and reducing their network reach through segmented access controls and controlled egress pathways.

Control: Cloud Native Security Fabric (CNSF)

Mitigation: Network segmentation and identity-aware routing would likely have constrained the compromised VPN appliance's access to critical internal resources, reducing the initial attack surface available to the attacker.

Control: Zero Trust Segmentation

Mitigation: Zero trust segmentation would likely have limited the blast radius of root-level compromise by constraining which network segments and workloads the elevated privileges could access beyond the VPN appliance itself.

Control: East-West Traffic Security

Mitigation: East-west traffic controls would likely have constrained lateral movement pathways and reduced the attacker's ability to reach Active Directory infrastructure from the compromised VPN segment.

Control: Multicloud Visibility & Control

Mitigation: Comprehensive visibility and control mechanisms would likely have detected and constrained the repeated exploit chain execution patterns and suspicious communication flows from the external IP address.

Control: Egress Security & Policy Enforcement

Mitigation: Controlled egress policies would likely have constrained outbound data flows and limited the attacker's ability to exfiltrate harvested credentials and sensitive organizational data through unauthorized channels.

Residual impact would likely be constrained to segmented network boundaries, reducing the overall business risk from widespread domain credential compromise and limiting unauthorized access scope across organizational resources.

Affected Business Functions

Network Security Infrastructure

Enterprise Authentication Systems

Corporate Network Connectivity

Estimated downtime: 7 days

Estimated loss: $250,000

Stolen credentials including LDAP domain credentials, Active Directory password searches, and potential access to internal corporate systems and data accessible through compromised VPN infrastructure

Key Takeaways & Steps

• Implement Zero Trust Segmentation to limit lateral movement from compromised VPN appliances to internal network resources

• Deploy Multicloud Visibility & Control capabilities to detect anomalous authentication patterns and repeated malformed requests targeting VPN endpoints

• Establish Egress Security & Policy Enforcement to monitor and control outbound traffic from network appliances to prevent credential exfiltration

• Enable Threat Detection & Anomaly Response systems to identify memory-only exploits and unusual access patterns that bypass traditional integrity checking tools

• Configure East-West Traffic Security controls to prevent compromised network appliances from accessing internal Active Directory services and conducting credential harvesting

Secure the Paths Between Cloud Workloads

A cloud-native security fabric that enforces Zero Trust across workload communication—reducing attack paths, compliance risk, and operational complexity.