Ethical Hacking News
Unveiling the Exploitation of Ivanti Connect Secure Zero-Days: A Threat to Enterprise Security
Ivanti Connect Secure VPN appliance vulnerable to zero-day flaws, allowing attackers to run commands as root without logging in. Attack exploited authentication bypass and remote code execution flaws, combined with privilege escalation to gain elevated privileges. Attacker, UTA0576, carried out attack on October 3, targeting a customer's fully patched appliance. Attack resulted in theft of stored credentials and execution of password-spraying attacks. Ivanti has released fixes for two flaws and is working on a fix for the third flaw, advising customers to upgrade and run Integrity Checker Tool regularly. Organizations must take immediate action to patch their appliances and implement robust vulnerability management practices.
The cybersecurity landscape is ever-evolving, with new vulnerabilities and exploits emerging on a regular basis. In recent times, a significant threat has come to light, targeting the Ivanti Connect Secure VPN appliance. According to a report by Volexity, a security firm, an attacker successfully chained three zero-day flaws in Ivanti Connect Secure to run commands as root without logging in. This discovery has significant implications for enterprise security, highlighting the importance of timely patching and vulnerability management.
Ivanti Connect Secure is a VPN appliance designed to provide secure connections for remote users. The vulnerability exploited by the attacker, CVE-2026-104935, is an authentication bypass and a remote code execution flaw. This combination of flaws allowed the attacker to run code as the appliance's cgi-server user, effectively gaining elevated privileges. The third flaw, a privilege escalation, raised the attacker's privileges to root, making it possible to execute arbitrary commands on the appliance.
The attack was carried out by an attacker tracked as UTA0576, who began exploiting the vulnerability on October 3. Volexity reported the flaws to Ivanti, which has since released fixes for two of the flaws. However, a fix for the third flaw is still pending, and Ivanti has advised customers on affected versions to "act immediately."
Volexity's investigation revealed that the attack was carried out on a customer's appliance that was fully patched at the time, with the appliance running version 22.8R2.4. The attacker, UTA0576, used a host IP address of 108.165.147[.]64 to carry out the attack. The attack was also characterized by the use of URL path manipulation, HTTP header manipulation, and directory traversal techniques.
The attack had significant consequences, including the theft of stored credentials, including LDAP domain credentials, and the execution of password-spraying attacks against the customer's accounts. The attacker also reran the entire exploit chain for each command, further compromising the security of the appliance.
Ivanti has since acknowledged the vulnerability and released a security advisory, which includes guidance for customers on affected versions. The company has also advised customers to upgrade to a newer version of the appliance and to run its Integrity Checker Tool regularly.
In response to this vulnerability, Ivanti has taken steps to improve the security of its products. The company has released fixes for two of the flaws and is working on a fix for the third flaw. Ivanti has also advised customers to upgrade to a newer version of the appliance and to run its Integrity Checker Tool regularly.
In light of this vulnerability, it is essential for organizations to take immediate action to patch their appliances and to implement robust vulnerability management practices. This includes regularly monitoring for new vulnerabilities, patching affected appliances promptly, and implementing additional security measures to prevent similar attacks.
The discovery of this vulnerability highlights the importance of staying vigilant and proactive in the face of emerging threats. As the cybersecurity landscape continues to evolve, it is essential for organizations to stay informed and to take steps to protect themselves against emerging threats.
Related Information:
https://www.ethicalhackingnews.com/articles/Unveiling-the-Exploitation-of-Ivanti-Connect-Secure-Zero-Days-A-Threat-to-Enterprise-Security-ehn.shtml
https://thehackernews.com/2026/10/attacker-chains-three-ivanti-connect.html
https://www.rapid7.com/blog/post/etr-ivanti-connect-secure-zero-day-exploited-in-the-wild-cve-2026-104935/
https://nvd.nist.gov/vuln/detail/CVE-2026-104935
https://www.cvedetails.com/cve/CVE-2026-104935/
Published: Tue Oct 13 14:25:26 2026 by llama3.2 3B Q4_K_M
