Ivanti patches VPN flaws exploited to gain root access

• 

  A previously undocumented threat actor chained three zero-day flaws to gain root-level access to a fully patched Ivanti Connect Secure VPN appliance.

• 

  Ivanti has patched two flaws covered by CVE-2026-104935, but the third, a privilege escalation vulnerability, remains unpatched.

• 

  Volexity said it found evidence of exploitation starting on October 3 and confirmed one victim.

• 

  The attacker focused on stealing credentials, searching for recovery keys, exploring the network and altering logs, according to Volexity.

• 

  Ivanti said exploitation affected a limited number of customers, and the operation was disrupted before the attackers’ ultimate goals became clear.

Who

The actor UTA0576, tracked by Volexity, exploited the flaws.

What

The attacker chained three zero-days to gain unauthenticated, root-level access to an Ivanti Connect Secure VPN appliance.

When

Volexity found evidence of exploitation starting on October 3; the year is not stated.

Where

On a fully patched Ivanti Connect Secure VPN appliance.

Why

The attacker focused on credential theft, data exfiltration and network reconnaissance; the ultimate goals were unclear.

This story does not have two clearly opposing sides.