WASHINGTON — The VPN appliance that stands between a company’s staff and its internal network was fully patched, and attackers got in anyway. That is the finding in a report published Tuesday by the security firm Volexity, which says an actor it tracks as UTA0576 chained three zero-day flaws in Ivanti Connect Secure to run commands as root without a password.
The compromised device ran version 22.8R2.4, then the newest release, and Volexity dates the exploitation to October 3. Ivanti shipped a fix Tuesday for the authentication bypass and remote code execution flaw, tracked as CVE-2026-104935. The third, a privilege escalation bug, is still unpatched, with a fix due “in the coming weeks,” according to Volexity. For ten days before any patch existed, the only defense was not knowing the door was there.
The US Cybersecurity and Infrastructure Security Agency added the flaw to its Known Exploited Vulnerabilities catalog the same day. In its alert, the agency said it is aware of attackers using the bug “to conduct credential theft and data exfiltration,” and listed the affected versions as 25.1.1.1 and prior, 25.1.2.2 and prior, and 22.8R2.4 and prior.
The harder problem is knowing whether a given appliance was already compromised. CISA’s alert warns that Ivanti’s Integrity Checker Tool “may not detect evidence of exploitation” because the attacker’s commands run in memory. Volexity’s report is blunter: the chain “patches library code in memory only and restores configuration store data,” so the tool sees nothing and only forensic investigation can find traces.
Once inside, the intruder went after credentials, Volexity says. It pulled stored credentials, tried to lift LDAP credentials from a packet capture on the appliance, and searched Active Directory for local administrator passwords and BitLocker recovery keys. It left no web shell, re-running the entire exploit chain for every command, and it deleted evidence from the appliance’s debug and audit logs.
Volexity also assesses, with medium confidence, that the actor uses large language models for exploit development, citing the chain’s complexity and scripts with hardcoded credentials. That is an inference, not proof, though it echoes TEH’s earlier reporting on OpenAI’s Astra and the Critical hacking threshold the company says the model crossed.
Volexity rates its confidence that the actor is criminal rather than espionage-driven as low, and it could not determine the intruder’s goal because the operation was disrupted. The report describes one compromised appliance and gives no count of victims, and the extent of the data taken is not established. For any administrator running these versions, the open question is how to prove nothing got in before the patch did.
