For the second time this autumn, an enterprise VPN appliance is under active attack. Attackers tracked as UTA0576 chained three zero-day vulnerabilities in Ivanti Connect Secure to get unauthenticated root access, even on fully patched appliances, starting October 3, 2026. Ivanti released fixes for two of them on October 13. The third, a privilege escalation flaw, is still waiting for a patch.
Table of Contents
What Happened
- October 3: UTA0576 begins exploiting the flaws against Ivanti Connect Secure appliances.
- October 13: security firm Volexity publishes its analysis, and Ivanti releases patches for CVE-2026-104935 (rated 8.6 out of 10) and a second flaw.
- Since then: CISA has urged organisations to patch, and the privilege escalation fix is promised in a future release.
Affected Versions
- Ivanti Connect Secure 25.1.1.1 and earlier
- Ivanti Connect Secure 25.1.2.2 and earlier
- Ivanti Connect Secure 22.8R2.4 and earlier
Check Ivanti's advisory for the exact fixed builds for your branch.
How the Attack Chain Works
- Authentication bypass: reach functions that should need a login.
- File upload weakness: plant code on the appliance, leading to remote code execution.
- Privilege escalation: go from a limited process to full root. This step is still unpatched.
Because no credentials or user clicks are needed, strong passwords and MFA don't help. It's the same pattern we covered with SonicWall's VPN zero-day in September.
What Admins Should Do
- Apply Ivanti's October 13 patches now.
- Assume possible compromise if your appliance was internet-facing between October 3 and patching. Run Ivanti's integrity checker and hunt for signs of intrusion, such as unexpected files and new admin accounts.
- Rotate credentials that the appliance could see: VPN user passwords, service accounts and certificates.
- Watch for the privilege escalation fix and apply it as soon as it ships.
- Limit exposure: restrict management interfaces to internal networks.
Why VPN Appliances Keep Getting Hit
Enterprise VPN gateways sit on the open internet, accept connections from anyone, and give access to whole internal networks. That makes them a high-value target. A consumer VPN app is a different shape of risk: it only makes outbound connections to its provider's servers and doesn't run a service strangers can log in to. See is a VPN hackable? for the honest risks that do apply to apps.
Frequently Asked Questions
What is CVE-2026-104935?
An authentication bypass and code-execution vulnerability in Ivanti Connect Secure, rated 8.6 out of 10, exploited as a zero-day from October 3, 2026 and patched on October 13, 2026.
Is the Ivanti zero-day fully patched?
Not yet. Ivanti patched two of the three chained flaws on October 13, 2026. The privilege escalation flaw is due in a future release.
Does this affect consumer VPN apps?
No. It affects Ivanti Connect Secure appliances used by organisations. Consumer VPN apps like CarrotVPN are unrelated.
Sources
- Volexity: A Series of Unauthenticated Events: Chained Exploitation of Ivanti Connect Secure Zero-Days
- The Hacker News: Attacker Chains Three Ivanti Connect Secure Zero-Days for Root Access
- Cybersecurity News: CISA Warns of Hackers Exploiting Ivanti Connect Secure Zero-Day
A Different Shape of VPN
CarrotVPN is a client app, not an internet-facing appliance: it only makes outbound WireGuard® connections. Free on Android.
Download CarrotVPN Free