Ivanti Connect Secure zero-days chained for root access - 2

A group of attackers has been breaking into Ivanti Connect Secure VPN gateways by chaining three security flaws, and it did so against devices that were fully up to date. Ivanti has now released fixes for the final two holes, according to BleepingComputer. [1] If your company or a client of yours lets staff connect to the office network through one of these gateways, check its version today, because a successful break-in gives the intruder the keys to the internal network.

What happened with Ivanti Connect Secure

Security firm Volexity reported that it spotted a previously unknown group, which it calls UTA0576, abusing an exploit chain in the first week of October 2026. [2] Sources differ slightly on the start: BleepingComputer says exploitation began around October 1 according to one tracker and October 3 according to Volexity. [1] Either way, the attacks started well before any patch existed for the full chain.

The chain joins three bugs. The first is an authentication bypass that lets a remote stranger run commands. The second lets a logged-in user upload files to a known place on the disk. The third lets a local user raise their rights to the top level. Together they give unauthenticated, root-level control of the gateway. [2]

Which flaws are involved and which versions are fixed

Ivanti published its advisory for the authentication bypass, CVE-2026-104935, on October 13. It scores 8.6 out of 10, and CISA put it on its list of known exploited flaws the same day. [3] The two newer bugs are CVE-2026-111357, a privilege escalation rated 8.8, and CVE-2026-118527, a file upload problem rated 4.3. [2]

Rapid7 notes that versions 22.7.x and older are not affected by the first flaw. [3]

How the attackers behaved once inside

Volexity says the group did not drop malware or a hidden web shell, which is what many defenders look for. Instead it exploited the device again for each command it wanted to run and tampered with logs so that Ivanti's own Integrity Checker Tool did not raise an alarm. [1] Inside victims' networks it pulled out credentials and some Active Directory details, scanned hosts, and hunted for administrator passwords and BitLocker recovery keys. [2]

That behavior matters for ordinary businesses. Stolen admin passwords and recovery keys are exactly what ransomware crews want. Our guide to Akira ransomware shows how such gangs typically move once they hold valid logins.

What Ivanti and CISA say

Ivanti has explained why the fix for the first bug came first, shipping it quickly instead of waiting for the others. [1] Once the privilege escalation bug turned up, the company said it chose not to hold back the fix that closed the main attack path, and that its first focus was disclosing the login bypass and protecting customers quickly. [2]

CISA added the two newer bugs to its Known Exploited Vulnerabilities catalog on October 30. US federal agencies had until November 2 to fix the privilege escalation flaw and have until November 13 for the upload flaw. [2] Shadowserver counts more than 5,000 Connect Secure systems reachable from the internet, though nobody knows how many are patched. [1]

Who is affected and what to do now

The people at risk are companies that run Connect Secure themselves: accountants, clinics, law firms, schools and local governments that give staff remote access. If you only use a VPN service from a consumer provider, this does not apply to you.

Open the admin panel and note the exact Connect Secure version.

Install the newest release for your line, such as 22.8R2.6 or 25.1.1.3 or later.

Assume the device may already be compromised if it was online and unpatched since early October, and follow Ivanti's recovery steps.

Reset passwords for every account that used the gateway, especially administrators and service accounts.

Review sign-in logs on your domain controllers and email for odd activity since October 1.

Rotate BitLocker recovery keys if administrators stored them where the gateway could reach.

Do not rely on the integrity checker alone. Ivanti says dependable indicators of compromise are not available, and Rapid7 urges teams to look for signs of intrusion even after the patch is applied. [3] Volexity has published some indicators on GitHub. [3]

This product has a long record. BleepingComputer counts 38 Ivanti flaws that CISA has flagged as exploited since November 2021, and 12 of them were also used in ransomware attacks. [1] Earlier exploited Connect Secure zero-days were patched in 2024 and 2025, including one used by China-linked state hackers. [1]

Be careful with unsolicited messages in the coming weeks. Criminals often follow big vulnerability news with fake alerts, such as the ones described in our page on the Critical Security alert scam, or extortion mails like the We hacked your system scam.

Frequently asked questions

No. This affects organizations that run Ivanti Connect Secure gateways. A consumer VPN app uses different software, though you can ask your employer whether your office VPN is an Ivanti product.

For the login bypass, Ivanti lists 25.1.1.2, 25.1.3.0 or 25.1.3.1, and 22.8R2.5. For the two newer bugs, the fixes are 25.1.1.3 and 22.8R2.6.

Not alone. The attackers were active from early October, so a device patched now may already have been compromised. Ivanti says reliable indicators are not available, and Rapid7 advises hunting for signs of intrusion after updating.

Volexity tracks the activity under the name UTA0576, a group it had not documented before. Its identity and location have not been reported.

According to Volexity, no malware or web shell was used. The group re-ran the exploit for each command and altered logs to avoid Ivanti's Integrity Checker Tool.

Shadowserver tracks over 5,000 Connect Secure instances reachable from the internet, and it is unknown how many are secured.

No yet. Be the first.