Ivanti Connect Secure zero-day chain gives root on patched VPNs

The Ivanti Connect Secure zero-day story that broke in October 2026 carries an uncomfortable detail: the VPN appliance the attackers broke into was fully patched. Security firm Volexity documented in-the-wild exploitation of a chain of zero-days in Ivanti Connect Secure (ICS), and the appliance it investigated was running version 22.8R2.4, the current release for its train at the time. By stringing three previously unknown flaws together, an attacker reached root-level code execution without a valid login. Volexity titled its report "A Series of Unauthenticated Events," and that phrase is the heart of the problem. Patching was not the control that failed here, because there was no patch to apply.

What happened

Volexity attributes the activity to a previously unknown actor it tracks as UTA0576, which it assesses with low confidence to be criminally rather than espionage motivated. The chain combined three separate flaws, each limited on its own (Volexity). The first is an authentication bypass in welcome.cgi, where the request's X-DSCGI-PATH header decides which script runs, letting a protected script be reached without authentication. The second is a file-write flaw in wu.cgi that writes an uploaded file before validating it, which an attacker can win a race to execute as a Perl script. The third is a privilege escalation in the dsinvoked broker, a component that runs maintenance tasks as root and trusts configuration data in DSCache. Together they carry an attacker from the open internet to root.

ZERO-DAY CHAIN

Ivanti tracks the authentication-bypass and remote-code-execution portion of the chain as CVE-2026-104935, rated CVSS 8.6, and released a patch for it on October 13, 2026, the same day Volexity published (Help Net Security). The privilege-escalation component was not given its own identifier in the original report; Volexity's later update says Ivanti shipped a separate fix, tracked as CVE-2026-111357, on October 29. Two Ivanti Connect Secure flaws, CVE-2026-111357 and CVE-2026-118527, were reported added to CISA's Known Exploited Vulnerabilities (KEV) catalog around October 30, with federal remediation due dates of November 2 and November 13 (Security Affairs). Treat those two catalog dates as provisional, since the reporting links to a CISA alert dated October 30 rather than stating the add date outright.

The timeline is tight. Volexity dates the exploitation to around October 3 and began investigating on October 5, after spotting the activity at a network-monitoring customer; a separate source cited by Help Net Security places the earliest confirmed instance on October 1. Ivanti has said the attacks affected a limited number of customers, and that it had found part of the flaw through its own product-security program and fixed it in a July release before it finished backporting that fix to other supported trains. The investigated appliance, on the 22.8 train, had not yet received it, which is how a device its owner believed was current was exposed.

Why it matters

The tradecraft is what makes this hard to catch. Volexity says the attacker deployed no malware and no web shell, and re-ran the full exploit chain for each command, using the appliance's own encrypted traffic as the command channel. The goals were credentials and directory data: a compromised Active Directory service account used to pull LAPS local-administrator passwords and BitLocker recovery keys, plus Kerberoasting, password spraying, and captured LDAP traffic. The operator then edited logs and deleted its own scripts. Volexity assesses with high confidence that this was preparation for lateral movement, though the activity was disrupted before the objective was clear. It also notes, with medium confidence, that the actor may have used large language models during the work.

This echoes the Cisco ASA and FTD VPN zero-day from days earlier, and the overlap is structural. VPN concentrators and firewalls are exposed to the internet by design, they sit in a privileged position between untrusted traffic and internal systems, and they rarely run the endpoint tooling that would catch an intrusion anywhere else. Reachable, privileged, and under-instrumented is the profile that keeps these appliances high on attacker target lists. And when the flaw is a zero-day, the usual advice to keep appliances patched is sound and would not have helped.

A fully patched appliance is not the same as a safe one, and a clean integrity check is not the same as an uncompromised device.

The Threatless read

"Fully patched" failing is not an argument against patching. It is a reminder that patching is one control among several, and that the first question after an edge-device advisory is often not the patch. It is about exposure: which VPN concentrators do you actually run, which are reachable from the internet, and what sits behind them. The appliance a team forgot it owned is the one that stays both unpatched and uninvestigated.

That picture, kept current, turns an advisory like this one into a short list of devices to check instead of a scramble. Knowing your attack surface tells you what is reachable; prioritizing by real risk decides what moves first when a flaw is unauthenticated, remote, and already exploited. Folding both into one continuous loop is the idea behind continuous threat exposure management, and it is the premise Threatless CTEM is built on: AI-native exposure management that keeps the picture of what you expose current, because the device you cannot see is the one you cannot defend. Patch the Ivanti appliances an attacker can reach today. Then, because this chain hides in memory, go and look.