An unknown threat actor chained three zero-day vulnerabilities to take control of a fully patched Ivanti Connect Secure (ICS) virtual private network (VPN) appliance, researchers at security firm Volexity said.
The chain let the attacker, tracked as UTA0576, run commands as the root superuser without logging in on an appliance running what was then the latest software version, 22.8R2.4.
Ivanti has patched two of the flaws, an authentication bypass and a remote code execution bug, under CVE-2026-104935.
However, a fix for the third, a privilege escalation, is still weeks away, Volexity said.
UTA0576 exploited the appliance from October 3, left no malware or web shell, and instead re-ran the whole chain for every command it issued.
It also patched Ivanti code in memory only and wiped its traces from the device’s logs, which blinds Ivanti’s Integrity Checker Tool.
“Because this exploit chain patches library code in memory only and restores configuration store data, the tool does not detect any modifications,” Volexity said.
Once inside, the attacker used the appliance’s Active Directory (AD) service account to hunt for local administrator passwords.
They also looked for BitLocker recovery keys, sprayed passwords, and sniffed plaintext credentials from traffic passing through the VPN.
Volexity assessed with medium confidence that UTA0576 used large language models (LLMs) to build its tooling but rated its view that the attacker was criminal rather than espionage-driven at only low confidence.
The security firm, which also sells the memory forensics software it used to uncover the chain, said it has confirmed one victim.
Rapid7 reported that Ivanti found part of the vulnerability internally and fixed it in version 25.1.3.0 in July, with exploitation occurring while it was still backporting that fix to other versions.
Fixed versions are 25.1.1.2, 25.1.3.0, 25.1.3.1 and 22.8R2.5. The 22.7 branch is unaffected.
Ivanti rated the flaw 8.6 on the CVSS scale, a high rather than critical score, despite it allowing unauthenticated command execution.
Last week, security vendor Fortinet outlined the ClingSTUN botnet that uses two older zero-days, which the Australian Signals Directorate issued an alert for in 2024.
The US Cybersecurity and Infrastructure Security Agency (CISA) have ordered federal agencies to patch by October 16, and added the bug to its Known Exploited Vulnerabilities (KEV) catalogue.
