Ivanti Connect Secure Zero-Day Chain Exploited for Root Access and Credential Theft

Attackers tracked as UTA0576 exploited a chain of zero-day vulnerabilities in Ivanti Connect Secure VPN appliances to gain unauthenticated root access and steal credentials. Volexity traced activity to October 3, 2026, and discovered a compromised appliance running the then-fully-patched version 22.8R2.4 during an October 5 investigation. The chain combined an authentication bypass, a temporary-file execution race, and privilege escalation through the dsinvoked service. Attackers targeted stored domain credentials, Windows LAPS administrator passwords, BitLocker recovery keys, and other sensitive Active Directory attributes.

Rather than deploying persistent backdoors or web shells, the attackers repeatedly exploited appliances, returned command results over HTTPS, and concealed activity by restoring modified settings and memory and deleting selected logs. Ivanti confirmed exploitation affecting a limited number of customers and released additional fixes on October 29, identifying 25.1.1.3 and 22.8R2.6 as resolving all disclosed vulnerabilities on their respective branches. Organizations should upgrade affected appliances and investigate potential credential exposure; Volexity warned that a clean Ivanti Integrity Checker result does not rule out compromise and recommended examining memory, disk, network activity, and suspicious request patterns.