As reported by The Hacker News, Volexity has disclosed a sophisticated three-zero-day exploit chain targeting Ivanti Connect Secure VPN appliances, tracked under threat actor designation UTA0576. Two of the three flaws are patched; the third—a privilege escalation—remains unpatched as of this writing. This creates an unusual and dangerous posture for defenders: upgrading eliminates most of the attack surface but may not fully neutralize the threat.
Vulnerability Details
| Field | Detail |
|---|---|
| Primary CVE | CVE-2026-104935 (authentication bypass + remote code execution, combined) |
| Third Flaw | Privilege escalation (cgi-server → root) — CVE identifier pending, patch not yet released |
| Affected Product | Ivanti Connect Secure (ICS) before version 25.1.3.0 |
| Unaffected Versions | 22.7R2.14 and prior; 22.8R2.5; 25.1.3.0; 25.1.3.1 |
| Vendor Advisory | Ivanti security advisory (see references) |
| Patch Status | Partial — two of three flaws fixed in 22.8R2.5 / 25.1.3.0+ |
| Active Exploitation | Yes — confirmed since October 3, 2026; Ivanti acknowledges "limited exploitation in the wild" |
| Threat Actor | UTA0576 (Volexity tracking designation) |
Why This Matters
This incident highlights a recurring and troubling pattern for perimeter security appliances: they are high-value targets, frequently complex, and their patch cycles cannot keep pace with determined adversaries. The fact that the compromised appliance was fully patched at version 22.8R2.4 at the time of exploitation underscores that defenders cannot rely on patch status alone as an indicator of security posture.
What makes this chain particularly insidious is the attacker's operational discipline. Rather than deploying a persistent web shell or backdoor—the typical tell that detection systems are tuned for—UTA0576 re-executed the full exploit chain for each command. This fileless, in-memory approach means traditional host-based artifact hunting will likely return nothing. The Integrity Checker Tool that Ivanti recommends also misses this chain because the exploit only modifies library code in memory and restores altered configuration data.
Who Is at Risk
Shield53 Recommendations
Immediate Actions
- Upgrade now to Ivanti Connect Secure 22.8R2.5 or 25.1.3.0/25.1.3.1. If on an older branch, this is not optional.
- Assume compromise for any appliance running affected versions that has been internet-facing since October 3, 2026. Patching alone is insufficient—you must investigate for prior exploitation.
- Hunt for IOCs: Monitor for high-volume requests to
/dana-na/auth/url_default/welcome.cgi, presence of theX-DSCGI-PATHheader with mismatched values, artifacts in/data/.icscap/, and any communication with108.165.147[.]64. - Rotate credentials: LDAP domain credentials, service accounts cached on the appliance, and any credentials stored in the appliance's credential store should be considered potentially compromised and rotated immediately.
- Deploy network-level detection: Since the exploit is fileless, focus on network flow analysis, TLS metadata, and egress anomalies from the appliance rather than host artifacts alone.
- Engage forensic support if exploitation is suspected—the in-memory nature of this attack requires network and memory forensics that standard incident response tooling may not capture.
Strategic Actions
- Reassess whether VPN concentrators require internet exposure for all management functions. Consider management plane segregation.
- Implement credential isolation so that VPN appliances do not hold privileged directory credentials with broad access.
- Monitor for the pending privilege escalation patch and plan an expedited deployment once released.
The half-patched state of this vulnerability chain means that even upgraded appliances may carry residual risk until the third flaw is addressed. Treat any Ivanti Connect Secure deployment as potentially compromised until the full patch set is available and forensic review is complete.
