errors.x7.al › Recent issues

CVE-2026-104935: reported zero-day chain gave attackers root on a fully patched Ivanti VPN

A newly assigned Ivanti Connect Secure vulnerability is at the centre of reports that attackers reached root-level access on a VPN appliance that was supposedly fully patched. Ivanti has released fixed versions and says exploitation is limited so far, while researchers describe a chain of three flaws.

What's happening

The vulnerability is tracked as CVE-2026-104935. According to SecurityWeek, it is a high-severity authentication bypass in Ivanti Connect Secure (ICS) that lets a remote, unauthenticated attacker execute arbitrary commands. Ivanti has said it is aware of exploitation affecting a limited number of customers, and released fixes on Tuesday in the form of ICS versions 22.8R2.5, 25.1.1.2, 25.1.3.0 and 25.1.3.1.

The most striking claim is that the attack did not depend on an out-of-date system. Per SecurityWeek and Volexity, a previously undocumented threat actor tracked as UTA0576 chained three zero-days to reach unauthenticated, root-level code execution on a fully patched ICS appliance (version 22.8R2.4). CVE-2026-104935 is said to cover two of those flaws — an authentication bypass and a remote code execution bug — while a third, privilege-escalation flaw reportedly remains unpatched, with the vendor planning to fix it in the coming weeks.

SecurityWeek reports that the actor's activity focused on credential theft, data exfiltration, network reconnaissance and log tampering: stealing domain credentials stored on the appliance, exfiltrating limited Active Directory metadata, searching Active Directory with a custom tool for LAPS passwords and BitLocker recovery keys, running password-spraying attacks and parsing authentication logs. Volexity says it found no backdoor or web shell on the device.

The U.S. cybersecurity agency CISA is also involved. According to reports, it added CVE-2026-104935 to its list of known exploited vulnerabilities and issued guidance for organisations. Note that the details above come from vendors and researchers; the full picture may change as analysis continues.

Who's affected

• Organisations running Ivanti Connect Secure VPN appliances, particularly internet-exposed deployments that have not yet moved to the fixed versions.
• Admins who assumed patching was enough. If reports are correct, the chain worked against a version that was current at the time, so a single update may not address every component.
• U.S. federal agencies, which were given a deadline to secure affected systems after the CVE was added to the known-exploited list.

What to do

• Identify your version and upgrade. Check the ICS build string against the fixed versions listed above and update promptly.
• Assume detection is hard. CISA reportedly cautioned that Ivanti's Integrity Checker Tool may not catch exploitation because commands run in memory, so pair patching with forensic checks.
• Hunt for indicators. Look for lateral movement originating from the VPN device, unusual LDAP or Kerberos activity, and authentication-log tampering.
• If compromised, rebuild. Guidance includes backing up the configuration, factory-resetting and upgrading (or rebuilding the instance), restoring the config, and then resetting all account passwords and reissuing certificates and stored keys.
• Keep watching. Because one flaw in the reported chain may still be unpatched, follow Ivanti and CISA advisories closely — this is an evolving situation.

Sources

• SecurityWeek — reports the CVE, the fixed versions, the "fully patched" root-access claim and the still-unpatched third flaw.
• The Hacker News — covers CISA's call for organisations to update their Ivanti Connect Secure appliances immediately.
• Volexity — the incident-response vendor's technical account of the three-flaw chain used against a patched appliance.