- Volexity found a threat actor chaining three zero-days to gain root on a fully patched Ivanti Connect Secure VPN, then going after Active Directory logins.
- Ivanti's integrity checker could not see the intrusion, so a clean scan does not prove the device is clean.
- The CVE-2026-104935 patch covers two of the three flaws. The privilege escalation fix is not yet released. Review traffic that starts at the VPN.
A clean scan is not a clean device
A common assumption is that a patched device with a clean checker result is a clean device. Volexity's new report shows where that assumption fails.
The researchers found an unknown attacker, tracked as UTA0576, taking full control of an Ivanti Connect Secure VPN. The device was fully patched at the time. It ran version 22.8R2.4, Build 19097.
The lesson here is simple. A patch level tells you what is installed. It does not tell you who is already inside.
A VPN sits at the edge of the network and holds keys to the inside. A gap in checking matters more there than in most places.
What happened
Volexity began its investigation on October 5, 2026. A customer of its network monitoring service showed signs of suspicious activity. Early work pointed to the VPN as the cause.
Volexity later found that the attacker had been using the flaws since October 3.
The attacker linked three flaws: an authentication bypass, a remote code execution flaw and a privilege escalation flaw. Together they gave full control of the device without a login.
Ivanti tracks the first two flaws as CVE-2026-104935. Patches for them came out on October 13.
The third flaw is not fixed yet. Volexity says Ivanti plans a fix in a release in the coming weeks. The report gives no CVE ID for that flaw.
How the attack works
The chain starts with a weak spot in how the device passes web requests to a handler for CGI scripts. CGI scripts are small programs that answer web requests. The code execution flaw sits in one of them, called wu.cgi.
The attacker used it to upload a Perl script. That script started a Bash script, which started a Python script.
The Python code arrived compressed and encoded. It ran straight from memory. The readable script was never saved to disk.
This gave the attacker control as a low-level user called cgi-server. A separate exploit then raised that access to root, the highest level.
The attack is also quiet. Volexity found no web shell and no backdoor. A web shell is a hidden page that lets an attacker send commands.
Instead, every command ran the whole chain again. The answer came back in the normal web response. With nothing left behind, there was little to find.
Ivanti's Integrity Checker Tool looks for changed files on disk. This attack changed code only in memory. It also put settings data back as it found it. The tool saw nothing. Volexity says a forensic investigation is required to spot this attack.
The attacker also wiped traces from Ivanti's debug logs and the Linux audit logs. Volexity had to collect memory and disk images and study crash files to rebuild the chain.
What the attacker went after
The target was identity. Active Directory is the system that controls logins across a Windows network. Volexity saw the attacker search it using the VPN's own service account.
The attacker hunted for LAPS passwords, which protect local administrator accounts. The attacker also hunted for BitLocker recovery keys, which unlock encrypted drives.
Volexity also found a packet sniffer running from a hidden folder. A sniffer records network traffic. Its filter was narrow. It watched only ports for services that send data unscrambled, among them LDAP, HTTP, FTP and telnet. Anything sent that way, such as a login, can be read straight off the wire.
A script then pulled passwords out of the captures. The attacker also tried guessing passwords against Active Directory accounts.
Volexity has high confidence that this was setup for moving deeper into the victim's network. The attack was stopped, so the final goal is unknown.
Volexity has low confidence that the motive is crime rather than spying.
Volexity also has medium confidence that the attacker used large language models to build the exploit and run later steps. It points to the chain's complexity and the very specific scripts. That is an assessment, not a confirmed fact.
One caveat applies to the cover-up. The recovered code can tamper with logs. Volexity says it has not fully shown how well each step worked on the victim device.
Questions for your team
First, has the CVE-2026-104935 patch reached every Ivanti Connect Secure device? Ivanti's advisory has the upgrade steps.
Second, what would we see if this device were already compromised? If the answer is the vendor's integrity checker, the report shows that is not enough.
Third, what can the VPN's service account reach in Active Directory? The attacker used that account to search for valuable data. Fewer rights mean less to steal.
Fourth, who watches traffic that starts at the VPN? Volexity advises forensic investigation of a VPN appliance that shows signs of compromise, such as attempts to move sideways from the device. That is a good reason to monitor traffic leaving it.
Finally, ask your vendor when the privilege escalation fix will ship. Until then, one link of the chain stays open.
A green checkmark answers one question: did the files change? It does not tell you whether someone has been in the room.
Produced by the WebPulse Newsroom with AI assistance from the original reporting credited below, and checked against that source by our editorial review. How we use AI.
Original reporting: Volexity.
