Ivanti VPN Flaw Lets Hackers Bypass Logins and Seize Root Access

A newly disclosed vulnerability in Ivanti Connect Secure is already being used by attackers to break into corporate networks without credentials, steal passwords, and quietly map out victims' Active Directory environments. Tracked as CVE-2026-104935 and rated 8.6 on the CVSS scale, the flaw lets an unauthenticated attacker bypass login protections and run arbitrary commands on internet-facing VPN appliances - the kind of equipment organizations depend on to let employees connect securely from outside the office.

How a routing quirk became a full compromise

The investigation that exposed the campaign began almost by accident. Security firm Volexity was called in to examine an Ivanti Connect Secure appliance that appeared fully patched, only to discover it had been compromised anyway. The culprit, a previously unknown group now tracked as UTA0576, had found a way to abuse how the appliance routes web requests. By sending a crafted header - X-DSCGI-PATH - alongside a request to a public welcome page, attackers could trick the system into processing a request meant for a protected, authenticated-only function instead. The server checked the public-facing URL for permission but quietly executed whatever the header pointed to.

That routing trick gave the attackers a path to an upload handler normally reserved for authenticated users. By disguising a malicious script as a compressed file, they exploited the brief window between when the file was written to disk and when the system verified and deleted it, sneaking in a second request to trigger execution before cleanup occurred. From there, the intruders launched a chain that handed them code execution under a limited service account - the first domino in a much larger fall.

From limited access to root, and a cleanup act built in

Low-privileged access alone would have been a serious problem. But UTA0576 paired the authentication bypass with a second, still-unpatched vulnerability involving a privileged background service, manipulating in-memory configuration to trick that service into running attacker-controlled code as root. Once in full control of the device, the attackers reversed their own changes, restoring modified files and stripping incriminating entries from system logs. Because much of the tampering happened only in memory, Ivanti's own Integrity Checker Tool - designed to catch unauthorized file changes - could plausibly miss it entirely.

Rather than installing a traditional backdoor, the attackers re-ran the entire exploit chain each time they needed to issue a new command, retrieving results directly through encrypted web traffic. This left behind unusually few traces, which is why Volexity has urged organizations to lean on network and memory forensics rather than disk inspection alone when investigating potential compromise.

Credentials, directories, and the real target

The appliance itself was never the endpoint of interest. Once inside, the attackers went after the data that opens the rest of a network: credentials stored on the VPN box, Active Directory queries, searches for Windows LAPS passwords and BitLocker recovery keys, and captured LDAP traffic. Password-spraying attempts and custom tooling built around Kerberos suggest a deliberate effort to validate stolen credentials before using them elsewhere. Volexity assesses with only low confidence that the group's motives are criminal rather than espionage-driven, and separately suspects - with moderate confidence - that large language models may have assisted in building or refining parts of the attack.

What organizations should do now

Ivanti has shipped fixes addressing the authentication bypass and code-execution components, though the separate privilege-escalation bug used to reach root was still unpatched as of Volexity's public disclosure. That makes applying the current update urgent in its own right: closing the initial entry point denies attackers the foothold needed to reach the still-open escalation flaw. The U.S. Cybersecurity and Infrastructure Security Agency has added the vulnerability to its Known Exploited Vulnerabilities catalog, giving federal civilian agencies a tight remediation deadline and signaling to every other organization that exploitation is active, not theoretical.

• Upgrade affected Ivanti Connect Secure deployments to the fixed releases identified by the vendor without delay.
• Continue running the Integrity Checker Tool, but do not treat a clean scan as proof of safety.
• Monitor for mismatches between requested URLs and X-DSCGI-PATH header values, and watch for unusual activity directed at Active Directory, LDAP, and DNS from the VPN appliance itself.
• Rotate credentials accessible through the appliance, including LDAP service accounts, once compromise is suspected or confirmed.

The episode is a reminder that perimeter devices built to secure remote access are themselves attractive, high-value targets. A fully patched appliance was still breached, underscoring that patching, integrity verification, and active network monitoring need to work together rather than standing in for one another.