A security firm has disclosed that an unidentified attacker strung together three previously unknown vulnerabilities in Ivanti Connect Secure, a widely deployed corporate VPN appliance, to gain root-level command execution without ever supplying a password. Volexity, which discovered the intrusion and reported the flaws to Ivanti, said the attack succeeded even against a fully patched appliance running the latest available version at the time. Ivanti has pushed out fixes for two of the three flaws and is urging affected customers to act without delay, while a patch for the third remains in development.
How the chain worked
Connect Secure, formerly known as Pulse Connect Secure, sits at the edge of corporate networks, authenticating remote employees and routing their traffic into internal systems. That position makes it a prime target: compromise the appliance, and an attacker potentially gains a foothold inside the network it was built to protect. According to Volexity, the attacker it tracks as UTA0576 combined an authentication bypass with a remote code execution flaw, together cataloged as CVE-2026-104935, to execute code as the appliance's internal cgi-server user without logging in. A separate privilege escalation vulnerability then elevated that access to root, the highest level of control on the system. The attacker began exploiting the chain on October 3, Volexity said, and Ivanti has confirmed it is aware of limited exploitation in the wild.
Who is affected and what to do
Ivanti's advisory lists Connect Secure versions before 25.1.3.0 as vulnerable, while version 22.7R2.14 and earlier builds are not affected. Versions 22.8R2.5, 25.1.3.0, and 25.1.3.1 are listed as safe. Organizations running anything in between should treat the advisory as urgent. Ivanti's standard guidance is to upgrade immediately and run its Integrity Checker Tool on a regular basis to detect tampering. In this case, that tool offers limited reassurance: Volexity found that the exploit alters library code only in memory, leaving the file system largely untouched, and that it restores configuration data after modifying it, specifically to evade detection by that scanning tool. Neither Volexity nor Ivanti has published a temporary workaround for organizations that cannot patch right away, nor have they clarified whether patching alone removes access an intruder may have already established.
What the intrusion reveals
In the case Volexity investigated, the attacker used the access to harvest stored credentials, including LDAP domain credentials, then searched Active Directory for additional passwords and launched password-spraying attempts against the accounts it found. No backdoor or web shell was left behind; instead, the attacker reran the full exploit chain each time it wanted to issue a command, a laborious but stealthier approach than planting persistent malware. Confirming whether a given appliance has been compromised requires forensic work, including analysis of network traffic and memory, since the changes do not persist in an obvious way on disk. Volexity flagged several indicators from the incident it examined, including repeated requests to a specific authentication URL path, an unusual HTTP header value, a distinctive directory created on the device, and a known attacker-controlled IP address.
Severity and broader context
Ivanti rates the combined authentication bypass and remote code execution flaw at 8.6 out of 10 on the industry's standard severity scale. The U.S. Cybersecurity and Infrastructure Security Agency has gone further in its own assessment, marking active exploitation and rating the technical impact as total. Volexity assesses with low confidence that the attacker's motive is criminal rather than tied to state-sponsored espionage, though neither organization has disclosed how many customers were targeted. The same advisory from Ivanti also addresses unrelated, critical-severity flaws in two other products, Xtraction and Neurons Patch for Intune, though the company says it has no evidence either has been exploited. Edge devices like VPN appliances have become recurring targets precisely because they sit outside conventional endpoint security, control the gateway into internal networks, and are not always patched as quickly as desktop software, making incidents like this one a recurring pressure point for enterprise security teams.