Ivanti Zero-Day Chain Gave Attackers Root Access to Fully Patched VPN
Ivanti VPN zero-day chain exploited for root access; credential theft and data exfiltration observed.
Ivanti has issued a warning about a zero-day vulnerability, CVE-2026-104935, affecting its Connect Secure VPN appliances. Exploited in the wild by a threat actor named UTA0576, the vulnerability chain allows unauthenticated attackers to gain root-level code execution. The attackers focused on credential theft, data exfiltration, and reconnaissance, potentially preparing for lateral movement within victim networks.
AI summary of the linked source. Not reviewed by an editor. How this works
Run Ivanti?
Get an email when a new story names Ivanti, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonA chained zero-day vulnerability in Ivanti Connect Secure VPN allowed unauthenticated attackers to achieve root-level code execution even on fully patched systems, demonstrating that patch compliance alone is insufficient against novel exploit chains. The threat actor UTA0576 weaponized CVE-2026-104935 to conduct credential theft, data exfiltration, and reconnaissance — classic precursors to deeper network compromise. This incident highlights the critical danger of exposing VPN appliances directly to the internet without compensating controls. Because the devices were already patched, defenders had limited traditional recourse, underscoring the need for behavioral detection, network segmentation, and rapid incident response capabilities around perimeter infrastructure.
What helps against this
How we list vendors
- Identity threat detection and response (ITDR)
Attackers who log in with real, stolen credentials get noticed.
- Zero trust network access (ZTNA)
Remote access no longer means exposing VPN appliances to the internet.
- Automated patch management
Known holes get closed in days, not months.
Indicators of Compromise
Extracted by AI from the linked source. Not reviewed by an editor. How this works
- cve — CVE-2026-104935