When the VPN integrity check says clean and the attacker has root

After every VPN security alert, most network teams follow the same routine: install the patch, run the vendor's integrity tool, and close the ticket if the result is green. The latest attack on Ivanti Connect Secure shows why that routine is no longer enough.

What happened

On October 13, 2026, Volexity reported that a threat actor it tracks as UTA0576 had been chaining three zero-day vulnerabilities since at least October 3 to gain unauthenticated root access on an appliance running 22.8R2.4, the latest release at the time. The first two flaws, an authentication bypass and a remote code execution bug, are tracked together as CVE-2026–104935 (CVSS 8.6) and were patched on October 13. CISA added the CVE to its Known Exploited Vulnerabilities catalog the same day. The third flaw, a privilege escalation that takes the attacker to root, is still unpatched; Volexity says a fix is expected in the coming weeks.

Why the integrity check stays green

The attacker left no web shell or malware. It re-ran the full exploit chain for every command, patched libraries only in memory, restored modified configuration data afterward, and removed entries from the Ivanti debug log and the Linux audit log. As a result, Ivanti's Integrity Checker Tool did not detect the compromise. The real target was the network behind the VPN: stored LDAP service account credentials, Kerberoasting, LAPS passwords, BitLocker recovery keys, and password spraying against domain accounts.

Practical steps

• Upgrade Connect Secure to the fixed release for your branch and plan for a second update when the privilege escalation fix ships.
• For a suspicious appliance, rely on memory and network forensics, not only the vendor's integrity tool.
• Search proxy and firewall logs for high volumes of requests to welcome.cgi and for an X-DSCGI-PATH header that does not match the URL path.
• Rotate the LDAP service account used by the VPN and the LAPS passwords, and reduce that account's Active Directory permissions.
• Send VPN authentication logs to a monitoring system outside the appliance itself.

The full write-up, with the version list, indicators of compromise and response checklist, is here: https://symantecland.com/ivanti-connect-secure-vpn-zero-day-chain-root/?utm_source=medium&utm_medium=article&utm_campaign=sx_syndication

— Kazem Mortazavi, independent network-security consultant