Tuesday 10 November 2026 950 stories on file Full archive
Daily Edition
newscms

Volume III Edition Daily

Fully Patched, Still Rooted: The Ivanti Connect Secure Zero-Day Chain That Outran Its Own Patch

When Ivanti announced on October 13, 2026, that its Connect Secure VPN appliances had been exploited in the wild, customers were told to "act immediately." The vulnerability—CVE-2026-104935—was rated an 8.6 on the CVSS…

Cybersecurity 1,096 words 5 min read By Hermes Publisher

Fully Patched, Still Rooted: The Ivanti Connect Secure Zero-Day Chain That Outran Its Own Patch — Cybersecurity No Image Cybersecurity
Lead image · Filed 14 October 2026, 04:46

Fully Patched, Still Rooted: The Ivanti Connect Secure Zero-Day Chain That Outran Its Own Patch

Introduction

When Ivanti announced on October 13, 2026, that its Connect Secure VPN appliances had been exploited in the wild, customers were told to "act immediately." The vulnerability—CVE-2026-104935—was rated an 8.6 on the CVSS scale and flagged by CISA as an active zero-day in its Known Exploited Vulnerabilities catalog. According to CISA's advisory, the exploit allows remote, unauthenticated execution of arbitrary commands. But the most unsettling revelation came from Volexity's forensic investigation: attackers gained root-level code execution on appliances that were fully patched at the time of compromise.

The kicker? The exploit chain leaves almost no forensic trail. No web shell. No backdoor. Just a memory-resident technique that bypasses the vendor's own integrity checker. In a world where patching is the primary defense, this incident reveals a terrifying gap: a vulnerability that can be exploited after the patch is applied, and a patch that leaves the system in a compromised state.

The Three-Flaw Chain

The attack vector, tracked as CVE-2026-104935, consists of three interconnected vulnerabilities that threat actor UTA0576 chained together for maximum impact. Volexity's investigation revealed that the first two flaws—an authentication bypass and a remote code execution (RCE) bug—allow an unauthenticated remote attacker to execute arbitrary commands as the low-privileged cgi-server user.

The third and most dangerous flaw is a privilege escalation vulnerability that promotes the attacker from cgi-server to root. This final vulnerability remains unpatched as of October 14, with Ivanti promising a fix "in the coming weeks."

The chain operates through a complex script cascade. When an attacker issues a command, the exploit first uploads a Perl script, which executes a Bash script, which in turn executes a Python script delivered in a Base64-encoded, zlib-compressed format. The Python script is decompressed and executed via exec() at runtime, meaning the raw script never touches disk. According to Volexity, this fileless execution model evades traditional disk-based detection entirely.

Memory-Only Execution Evades Integrity Checks

Ivanti provides an Integrity Checker Tool designed to identify unexpected file modifications on disk. But as CISA's advisory notes, "Ivanti's Integrity Checker Tool may not detect evidence of exploitation because threat actor commands execute in memory."

The exploit patches library code in memory only, then restores configuration store data to its original state. Forensic investigators had to deploy memory analysis tools—specifically Volexity's Volcano—to reconstruct what happened. The company's analysis revealed dozens of JSON files in /tmp/ containing exfiltrated Active Directory data, Python scripts for LAPS password harvesting, and packet capture files being parsed for LDAP credentials.

This memory-only approach means organizations cannot rely on file integrity monitoring alone. CISA's recovery guidance reflects this reality: organizations must perform factory resets, upgrade the appliance, and restore from backup—not just apply patches.

Credential Theft at Scale

UTA0576's post-exploitation activities were extensive and methodical. Within hours of gaining initial access on October 3, 2026, the threat actor began harvesting credentials from the compromised Ivanti appliance. The attacker used a custom LDAPv3 tool to query Active Directory for high-value attributes, including Local Administrator Password Solution (LAPS) passwords and BitLocker recovery keys.

The exfiltration strategy was equally sophisticated. The attackers exported AD query results as Base64-encoded, zlib-compressed JSON files, stored in /tmp/, and exfiltrated them via the same exploit channel. They also captured packets on TCP port 389 (LDAP) using a BPF socket filter, then parsed the capture files to extract plaintext credentials and HTTP Basic Authentication credentials.

Password-spraying campaigns ran against discovered accounts using a custom Kerberos implementation. The attacker wrote a Python implementation of Kerberos to /tmp/mk.py and an accompanying test script to /tmp/rr.py, running credential tests against the compromised domain controller.

Log Tampering and Anti-Forensics

Perhaps most concerning were the anti-forensic measures built into the exploit chain. Volexity's analysis identified code designed to perform selective log modification, remove temporary execution artifacts, and restore altered system state. The attacker deleted evidence from both Ivanti debug logs and Linux audit logs.

The tool did not deploy a traditional web shell or backdoor. Instead, the threat actor reran the entire exploit chain for each command issued, returning results through HTTPS requests to avoid establishing a separate command-and-control channel.

What Organizations Should Do

CISA's recommended recovery steps reflect the memory-only nature of this attack:

  1. Create a backup of the appliance configuration before taking any action.

  2. Conduct a factory reset and upgrade to the latest version. For cloud and virtual systems, rebuild the virtual instance entirely.

  3. Restore the appliance configuration from the backup created in step 1.

  4. Reset all passwords—domain, administrator, and local accounts—and revoke and reissue all certificates, API keys, and license server credentials.

The key insight: patching alone is insufficient when an attacker has already established a foothold. Organizations must assume the appliance is compromised and execute a full recovery cycle. For teams tracking VPN and firewall exposure across their cybersecurity posture, this incident is a reminder that edge appliances need memory forensics, not just configuration audits.

A New Era of Zero-Day Exploitation

The Ivanti incident joins a growing list of zero-days where fileless, memory-resident techniques have evaded traditional detection. The CVE-2026-104935 chain demonstrates that patching is not a panacea when the exploit persists in memory and leaves no disk artifacts. The gap between what a patch fixes and what an attacker can still do inside a running process is now the central question for every security team that manages edge appliances.

For defenders, this means shifting from a patch-and-pray model to continuous memory forensics and threat hunting. For organizations running Ivanti Connect Secure, the security recommendation is clear: assume breach, execute recovery, and wait for the privilege escalation patch before bringing the appliance back online.

Images

Buffalo WR-S1000 VPN router showing LED status indicators on a desk Caption: Physical VPN router device (BUFFALO WR-S1000) that could be targeted by zero-day exploits. The LEDs indicate active connections on POWER, WAN, and LAN ports.

Network equipment setup with modem, routers, and external storage Caption: Home network equipment including a cable modem, wireless routers, and external storage—a common attack surface for VPN-based zero-days.

Abstract cybersecurity graphic with padlock over circuit board Caption: Conceptual representation of cybersecurity defenses protecting digital infrastructure from unauthorized access.

References