Ivanti Zero-Day Chain Gave Attackers Root Access to Fully Patched VPN

An attacker, identified as UTA0576, exploited three previously unknown vulnerabilities in Ivanti Connect Secure to gain root-level access to a VPN appliance without needing to authenticate. The security firm Volexity discovered this chain of attacks and reported them to Ivanti on October 13, 2026. The first two vulnerabilities allowed the attacker to bypass authentication and execute arbitrary code, while the third flaw enabled the attacker to escalate their privileges to root.

Ivanti has released patches for two of the flaws, but the third, a privilege escalation vulnerability, is still unpatched. Organizations using Ivanti Connect Secure versions prior to 25.1.3.0, except for 22.7R2.14 and 22.8R2.5, are affected by this chain of exploits. The vulnerability rating for the three combined flaws is 8.6 out of 10 on the CVSS scale, with exploitation classified as active and the technical impact described as total.

Ivanti has advised customers to upgrade their software and regularly run the Integrity Checker Tool. However, Volexity has stated that this tool is unable to detect the specific chain of vulnerabilities. In the single incident Volexity investigated, the attacker stole stored credentials, including LDAP domain credentials, searched Active Directory for passwords, and carried out password-spraying attacks.

The attacker's motive was suspected to be criminal rather than espionage, based on limited evidence from a single case. Ivanti recommends upgrading to a patched version and running the Integrity Checker Tool regularly, but no interim mitigation has been provided for the pending privilege escalation fix.