Ivanti Connect Secure zero-day chain reached root and exposed directory secrets

Volexity reports that actor UTA0576 began exploiting an Ivanti Connect Secure (ICS) VPN appliance on October 3; its investigation began October 5. The appliance was running 22.8R2.4, build 19097, which Volexity describes as fully patched at the time. The chain combined an authentication-bypass and remote-code-execution path tracked as CVE-2026-104935 with a separate privilege-escalation flaw to reach root. (Volexity incident report)

Volexity's public report describes one customer investigation and does not establish how many other appliances were targeted or compromised. Volexity reconstructed the chain using memory, disk images and crash data. After gaining code execution as the appliance's web service account, UTA0576 abused the privileged dsinvoked service's trust in DSCache configuration data to run commands as root. On October 15, the CVE Program published CVE-2026-111357 for this separate root privilege-escalation issue, describing ICS 22.8R2.4 as affected. Volexity's October 13 report predates that CVE assignment. (CVE-2026-111357 record)

After gaining root, UTA0576 used appliance credentials to query Active Directory and search for high-value records, including Local Administrator Password Solution passwords and BitLocker recovery information. Volexity says the actor exported directory results and LDAP packet data. Commands and results passed through the exploit's HTTPS requests; Volexity did not find a separately installed web shell or backdoor. The report also describes log deletion and in-memory changes restored by the attacker. Because the changes were not left on disk, Volexity says Ivanti's Integrity Checker Tool did not detect this chain and recommends forensic investigation when compromise is suspected. (Volexity incident report)

Ivanti's October 13 advisory fixes the CVE-2026-104935 authentication-bypass and code-execution path. Its listed fixed releases are 25.1.1.2 for the affected 25.1.1.1-and-earlier line, 25.1.3.0 or 25.1.3.1 for the affected 25.1.2.2-and-earlier line, and 22.8R2.5 for 22.8R2.4 and earlier. Check Ivanti's advisory for the correct release for each appliance platform. CISA added CVE-2026-104935 to its Known Exploited Vulnerabilities catalog on October 13, with an October 16 federal remediation deadline. These releases address CVE-2026-104935; they should not be treated as a fix for the separate CVE-2026-111357 root-escalation flaw. Volexity said on October 13 that Ivanti was preparing a future fix for that flaw, and the CVE record, updated October 16, still lists 22.8R2.4 as affected and provides no remediation guidance. No later official fix notice was found in this review. (Ivanti security advisory; CISA exploitation alert; CISA KEV catalog; CVE-2026-111357 record)

Volexity assesses with medium confidence that UTA0576 may have used large language models during exploit development and post-exploitation work. That is an analyst assessment based on the observed command patterns and exploit complexity. The report identifies no model and does not establish that AI was used in the intrusion or attribute the activity to a named group.