Three Zero-Days Break Into Ivanti VPN Appliances, and Scanning Tools Saw Nothing
VPN appliances are the door employees use to reach company networks from home, which is exactly why they have become one of attackers' favorite targets. In October 2026, security firm Volexity uncovered a carefully engineered attack on Ivanti Connect Secure appliances that chained three zero-day vulnerabilities to gain root control of the device, even though it was fully up to date.
What happened?
According to Volexity's report published on October 13, the company spotted suspicious activity on a customer's VPN appliance in the first week of October and found the attacker had been on the device since at least October 3. Volexity tracks the actor as UTA0576, without attributing it to a country or known group.
The targeted device ran 22.8R2.4, the latest version available at the time. Regular patching was not enough, which is precisely what makes zero-days so dangerous.
A chain of three flaws
Link one: login bypass
On the device's public login page, a mismatch in how a request path inside the headers is handled let the attacker skip authentication entirely.
Link two: remote code execution
The attacker then abused the file upload feature, uploading a Perl script disguised as a ZIP file and racing to run it in the split second before the device deleted it after a failed check, a classic race condition.
These two links are tracked as CVE-2026-104935, rated 8.6 out of 10. CISA added it to its Known Exploited Vulnerabilities catalog on the day of disclosure.
Link three: root privileges
The third flaw sat in a privileged internal service. The attacker briefly patched a shared configuration in memory to run commands as root, then restored it to leave no trace.
What did the attacker do next?
- Used the appliance's service account to query the domain controller for local admin passwords and BitLocker recovery keys.
- Captured network traffic to collect cleartext credentials.
- Ran password spraying and Kerberos attacks against employee accounts.
- Compressed the results and sent them back through the exploit channel inside normal-looking HTTPS responses.
Volexity assesses with high confidence that this was groundwork for lateral movement, but the operation was detected and disrupted before its final goal became clear.
Why didn't scanning tools catch it?
The attack was remarkably clean. No backdoor or web shell was planted; the full exploit chain was re-run for every command. Selected log entries were deleted, and the packet capture tool was hidden under a renamed executable in a directory that does not appear in normal listings.
As a result, Ivanti's Integrity Checker Tool found nothing, because it checks files on disk while everything happened in memory. A clean scan does not necessarily mean a clean device.
Volexity also assesses with medium confidence that the actor used large language models to help build the exploit and post-exploitation tools.
Why VPNs became a favorite target
This is not the first wave of attacks on Ivanti devices; recent years have seen repeated campaigns against edge devices from many vendors. The reason is simple: these devices face the internet by design, run closed systems where security teams cannot install their usual tools, and connect directly to user directories and passwords. Breaching one VPN appliance gives an attacker a foothold inside the network without phishing a single employee.
Does this affect regular employees?
If you connect to work over VPN, you probably won't notice anything; the attack happens on the appliance, not your laptop. But your work password may be among what was collected, so if IT asks you to change it, do it right away, turn on two-factor authentication wherever you can, and never reuse your work password on personal accounts.
Is there a fix?
On October 13, Ivanti released fixes for the authentication bypass and code execution flaws in 22.8R2.5, 25.1.1.2, 25.1.3.0 and 25.1.3.1. Affected versions are 22.8R2.4 and earlier, 25.1.1.1 and earlier, and 25.1.2.2 and earlier.
The third, privilege escalation flaw remains unpatched at the time of writing; Ivanti says a fix will come in a future release without giving a date.
What companies should do now
- Install the fixed version on an emergency basis.
- Hunt for signs of compromise even after patching, using the indicators Volexity published on GitHub.
- Review the appliance's service account and cut its Active Directory permissions to the minimum.
- Rotate sensitive credentials that may have passed through the device and review repeated failed logins.
- Monitor outbound traffic from the VPN appliance for unusual connections to domain controllers.
Final decisions such as resetting or isolating the device belong to the organization's security team.
The bottom line
This attack captures a clear trend: attackers no longer need to leave malware behind and can work from memory, vanishing after each step. Edge devices like VPNs and firewalls are prime targets because they face the internet and connect to the heart of the network. Fast patching is essential, but on its own it is no longer enough without continuous monitoring.
Sources: Volexity, Rapid7, Security Affairs and BleepingComputer.
Because protecting networks is everyone's job in a connected world, our interest extends from following Arabic websites and specialized blogs, to what Egypt stores, Kuwait stores, vitamin stores and international sites offer, with Mashhor for social media services as a key to growth.
That's it, friends. We hope you found this useful ✌
Best wishes from the #Ezznology team.
Join our community on Telegram and our Facebook group, and follow us on Google News.
You may also like:
What Is a Zero-Day Vulnerability?
Windows October 2026 Update: Microsoft Fixes 1,411 Flaws Including an Exploited Zero-Day
