{"id":2115,"date":"2026-10-14T07:20:07","date_gmt":"2026-10-14T00:20:07","guid":{"rendered":"https:\/\/vncybers.vn\/canh-bao-ivanti-connect-secure-zero-day-cve-2026-104935\/"},"modified":"2026-10-14T07:20:07","modified_gmt":"2026-10-14T00:20:07","slug":"ivanti-connect-secure-zero-day-cve-2026-104935-alert","status":"publish","type":"post","link":"https:\/\/vncybers.vn\/en\/canh-bao-ivanti-connect-secure-zero-day-cve-2026-104935\/","title":{"rendered":"Ivanti Connect Secure Alert: CVE-2026-104935 Zero-Day Exploited for Root Access"},"content":{"rendered":"

CVE-2026-104935<\/strong>, l\u1ed7 h\u1ed5ng v\u01b0\u1ee3t qua x\u00e1c th\u1ef1c nghi\u00eam tr\u1ecdng tr\u00ean Ivanti Connect Secure, \u0111\u00e3 b\u1ecb khai th\u00e1c nh\u01b0 zero-day trong chu\u1ed7i t\u1ea5n c\u00f4ng cho ph\u00e9p th\u1ef1c thi l\u1ec7nh v\u1edbi quy\u1ec1n root. Ivanti ph\u00e1t h\u00e0nh b\u1ea3n v\u00e1 ng\u00e0y 13\/10\/2026, trong khi CISA \u0111\u01b0a l\u1ed7 h\u1ed5ng v\u00e0o danh m\u1ee5c Known Exploited Vulnerabilities ngay trong ng\u00e0y c\u00f4ng b\u1ed1.<\/p>\n

\"Ivanti
The Ivanti Connect Secure exploit chain analyzed by Volexity. Image: Volexity<\/figcaption><\/figure>\n

How Was the Zero-Day Chain Discovered?<\/h2>\n

Volexity began investigating suspicious activity on October 5 and identified an Ivanti Connect Secure appliance running version 22.8R2.4, considered fully patched at the time, as the initial access point. Forensic evidence showed that threat actor UTA0576 had exploited the system since at least October 3; another observer recorded signs as early as October 1.<\/p>\n

The attack chain combines authentication bypass, a file-write path to code execution, and privilege escalation. The first two components are tracked as CVE-2026-104935; Ivanti is still addressing the separate privilege-escalation flaw and plans to patch it later.<\/p>\n

What Does CVE-2026-104935 Enable?<\/h2>\n

The vulnerability carries a CVSS score of 8.6 and is classified as CWE-290 authentication bypass by spoofing. An unauthenticated remote attacker can route requests from the public login page to an internal CGI, upload a specially crafted file, and exploit the brief window before deletion to execute code.<\/p>\n

The actor then abuses how a privileged service trusts configuration data to run code as root. Every command is sent through a fresh exploitation attempt and its output is returned in the HTTPS response, eliminating the need for a web shell or separate command-and-control channel.<\/p>\n

Active Directory Credentials Were the Target<\/h2>\n

After taking control of the VPN appliance, UTA0576 focused on credentials and secrets in Active Directory. Observed activity included extracting LDAP accounts stored on the device and searching for LAPS local administrator passwords, BitLocker recovery keys, password-bearing attributes, and domain metadata.<\/p>\n

The attacker also deployed a custom Kerberos tool, attempted password spraying, surveyed the internal network, and analyzed LDAP traffic for plaintext credentials or crackable material. Because a VPN appliance sits at the edge yet often connects deeply into identity infrastructure, a compromise can quickly expand into the internal environment.<\/p>\n

Anti-Forensic Techniques Increase the Risk<\/h2>\n

Volexity said the actor selectively removed evidence from Ivanti debug logs and Linux audit logs while restoring in-memory changes after privilege escalation. Intermediate payloads largely ran in memory, and temporary files were deleted after use.<\/p>\n

The exploit chain leaves no persistent web shell and can evade the Integrity Checker Tool because that utility primarily looks for file changes on disk. A clean integrity check therefore cannot prove that an appliance was not compromised; organizations need forensic investigation when lateral movement or unusual activity originates from the VPN.<\/p>\n

Affected and Fixed Versions<\/h2>\n
    \n
  • 25.1.1.1 and earlier in that branch: upgrade to 25.1.1.2.<\/li>\n
  • 25.1.2.2 and earlier in that branch: upgrade to 25.1.3.0 or 25.1.3.1.<\/li>\n
  • 22.8R2.4 and earlier in that branch: upgrade to 22.8R2.5.<\/li>\n<\/ul>\n

    According to the vendor advisory, versions 22.7.x and earlier are not affected by this CVE. Organizations should still consult Ivanti's latest advisory directly because support status and recovery guidance may change.<\/p>\n

    Why Must Organizations Patch and Hunt for Compromise?<\/h2>\n

    The patch blocks new exploitation of CVE-2026-104935 but does not remove the consequences of a compromise that already occurred. CISA confirmed exploitation and added the flaw to KEV, while Rapid7 recommends emergency remediation outside normal patch cycles.<\/p>\n

    Organizations should treat appliances as at risk if they ran an affected version during the exploitation window, preserve evidence before rebuilding, and review accounts used by the VPN. If suspicious signs appear, they should rotate LDAP credentials, service accounts, keys, and related tokens instead of only upgrading the software.<\/p>\n

    Priority Action Checklist<\/h2>\n
      \n
    • Inventory every Ivanti Connect Secure appliance, including standby units and provider-managed systems.<\/li>\n
    • Immediately upgrade to the appropriate fixed version and confirm normal service after the change.<\/li>\n
    • Collect logs, memory images, or disk images before recovery when compromise is suspected; do not rely only on the Integrity Checker Tool.<\/li>\n
    • Look for unusual LDAP, Kerberos, password-spraying, LAPS, and BitLocker queries originating from the VPN appliance's address.<\/li>\n
    • Rotate potentially exposed credentials and monitor for lateral movement in Active Directory.<\/li>\n<\/ul>\n

      Lessons for Remote-Access Systems<\/h2>\n

      A VPN appliance is a frontline identity server, not merely a network device. Its internet exposure, stored domain connection details, and visibility into authentication traffic make it a high-value target and an effective launch point into enterprise networks.<\/p>\n

      This incident shows that vulnerability management must be paired with behavioral monitoring and forensic capability. For an edge device with confirmed exploitation, the safe strategy is to patch immediately, review historical activity, revalidate related secrets, and continue monitoring Ivanti advisories and Volexity's published indicators.<\/p>\n

      VNCyberS<\/strong> compiled from Ivanti, Volexity, Rapid7, and BleepingComputer<\/em><\/p>","protected":false},"excerpt":{"rendered":"

      CVE-2026-104935, l\u1ed7 h\u1ed5ng v\u01b0\u1ee3t qua x\u00e1c th\u1ef1c nghi\u00eam tr\u1ecdng tr\u00ean Ivanti Connect Secure, \u0111\u00e3 b\u1ecb khai th\u00e1c nh\u01b0 zero-day trong chu\u1ed7i t\u1ea5n c\u00f4ng cho ph\u00e9p th\u1ef1c thi l\u1ec7nh v\u1edbi quy\u1ec1n root. Ivanti ph\u00e1t h\u00e0nh b\u1ea3n v\u00e1 ng\u00e0y 13\/10\/2026, trong khi CISA \u0111\u01b0a l\u1ed7 h\u1ed5ng v\u00e0o danh m\u1ee5c Known Exploited Vulnerabilities ngay trong ng\u00e0y c\u00f4ng b\u1ed1. […]<\/p>\n","protected":false},"author":2,"featured_media":2114,"comment_status":"","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"inline_featured_image":false,"footnotes":""},"categories":[1],"tags":[459,46,167,952,954,953,955,950,93],"class_list":["post-2115","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-tin-tuc","tag-active-directory","tag-an-ninh-mang","tag-cisa-kev","tag-cve-2026-104935","tag-ivanti","tag-ivanti-connect-secure","tag-uta0576","tag-vpn","tag-zero-day"],"_links":{"self":[{"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/posts\/2115","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/comments?post=2115"}],"version-history":[{"count":0,"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/posts\/2115\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/media\/2114"}],"wp:attachment":[{"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/media?parent=2115"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/categories?post=2115"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/tags?post=2115"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}