Attackers steal credentials from patched Ivanti gateways using zero-day chain

A previously unknown threat actor successfully extracted sensitive credentials from enterprise networks by exploiting a chain of three zero-day vulnerabilities in Ivanti Connect Secure remote access gateways. According to cybersecurity firm Volexity, the group, tracked as UTA0576, achieved unauthenticated root-level access on devices that had already received the latest security updates for known issues. This demonstrates that standard patching procedures did not protect these specific appliances against this sophisticated intrusion method.

The activity began on 3 October 2026, targeting an appliance running version 22.8R2.4. Volexity discovered the intrusion while investigating suspicious behaviour at a customer site and collaborated with Ivanti to analyse the compromised device. The attackers used the access to search for and steal domain credentials, Local Administrator Password Solution passwords, BitLocker recovery keys and other directory information. They operated without installing malware or web shells, making detection difficult.

What we know

Volexity reported that UTA0576 combined an authentication bypass and a file-write weakness, tracked together as CVE-2026-104935, with a separate privilege-escalation flaw. Ivanti released a fix for CVE-2026-104935 on 13 October, but the privilege-escalation issue remained under development. The initial bypass misused how the appliance handled web requests, allowing attackers to reach protected scripts. By abusing the file-upload handler, they placed a script on the device and executed it before the system deleted it.

After gaining initial code execution as the cgi-server user, the actor used the privileged dsinvoked service to elevate access to root. The exploit modified configuration data in memory, ran an attacker-supplied script, and then restored original settings. This in-memory manipulation meant that Ivanti’s Integrity Checker Tool might not detect signs of compromise. The group also removed selected entries from Ivanti debug and Linux audit logs to cover their tracks.

Threat intelligence company Defused confirmed Volexity’s findings, noting it saw the first signs of CVE-2026-104935 exploitation starting 1 October. Shadowserver tracks over 5,500 Ivanti Connect Secure instances exposed online, though it is unclear how many are honeypots or secured. Ivanti stated it is aware of limited exploitation in the wild and is working directly with affected organisations. The company urged customers to upgrade to fixed versions and run the Integrity Checker Tool regularly.

Defender's checklist

• Verify if your Ivanti Connect Secure appliances run versions 22.8R2.4, 25.1.2.2 or 25.1.1.1 or earlier.
• Check for the presence of unexplained script executions or configuration changes in memory logs.
• Monitor for unusual outbound connections that do not correlate with standard remote access traffic.
• Review audit logs for gaps or deleted entries that might indicate tampering by an intruder.

The background in plain language

Remote access gateways act as secure checkpoints for employees working outside the office. A zero-day vulnerability is a security flaw unknown to the vendor, meaning no patch exists when attackers first use it. Chaining flaws means exploiting multiple weaknesses in sequence to bypass different layers of defence. Privilege escalation allows a low-level user account to gain high-level administrative rights. Root access is the highest level of control on a Linux-based system, allowing an attacker to read, modify or delete any data on the device.

Background: Privilege escalation vulnerabilities

Detect privilege escalation by correlating authentication logs with file permission changes and process creation events. Look for unusual parent-child process relationships, unexpected service account usage and deviations from baseline behaviour. Use endpoint detection platforms to catch runtime anomalies that static scans miss.

Read the full guide: Detect Privilege Escalation: Signals, Tools and Blind Spots

What to do and how to stay safe: Ivanti

• Identify all Ivanti Connect Secure devices in your environment and check their current software versions against the affected list.
• Once the vendor provides an update for the privilege-escalation flaw, apply it immediately to all impacted appliances.
• Monitor network traffic for unusual patterns that might indicate command-and-control activity from compromised gateways.
• Assume that standard integrity checks may miss in-memory attacks and consider additional logging or behavioural monitoring.

Step-by-step guide: Virtual Patching: Benefits, Limits and When to Use It

General security guidance from the TechWire Beat newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Which Ivanti Connect Secure versions are affected by CVE-2026-104935?

Versions 22.8R2.4 and earlier, 25.1.2.2 and earlier, and 25.1.1.1 and earlier are affected.

Has Ivanti released a fix for all the flaws used in this attack?

Ivanti released a fix for CVE-2026-104935 on 13 October, but the privilege-escalation flaw remains under development.

Did the attackers install malware on the compromised devices?

No, Volexity reported that UTA0576 deployed no malware or web shells, re-exploiting the device for each command.