Another Corporate VPN Hacked: Ivanti Zero-Day Gives Attackers Root Without a Password

It happened again. One day after the GlobalProtect ransomware story, a second corporate VPN has been breached through its own front door.

Security firm Volexity disclosed on October 13 that an unknown threat actor, tracked as UTA0576, chained three zero-day vulnerabilities in Ivanti Connect Secure to achieve unauthenticated root-level code execution. The target was a fully patched appliance running version 22.8R2.4. No credentials were needed. No phishing email. The attacker simply walked in through the VPN gateway itself.

The chain combined an authentication bypass, a remote code execution flaw, and a privilege escalation bug. Ivanti tracks the first two under CVE-2026-104935 and released patches on October 13. The privilege escalation fix is still coming in a future release, which means even patched systems remain partially exposed.

What the attackers took

Volexity found evidence of exploitation starting October 3, ten days before disclosure. In that window, UTA0576 focused on credential theft at scale. The attackers stole domain credentials stored on the appliance, searched Active Directory for LAPS passwords and BitLocker recovery keys, ran password-spraying attacks, and captured network traffic looking for more credentials.

They also tampered with logs, modifying and then restoring in-memory system state and removing entries from debug and audit logs. Volexity warns that Ivanti’s own Integrity Checker Tool may not detect this activity, because the key changes happened in memory rather than leaving persistent file modifications. The attackers never installed a backdoor or web shell. They sent commands and retrieved results through the exploit channel itself, leaving almost nothing behind.

CISA has added CVE-2026-104935 to its Known Exploited Vulnerabilities catalog, with a federal patching deadline that underscores the urgency.

The pattern is the story

This is the second time in a week that a major enterprise VPN has been breached through vulnerabilities in the gateway itself. Last week it was Palo Alto GlobalProtect and ransomware groups. This week it is Ivanti Connect Secure and credential thieves. Different vendors, different attackers, same lesson.

Corporate VPNs sit at the edge of company networks by design. That makes them high-value targets, and when they fall, everyone connected through them is exposed through no fault of their own. You cannot patch your employer’s VPN. You cannot audit its logs. You cannot verify that sessions were terminated after the fix. You are entirely dependent on infrastructure you do not control.

That dependence is the real vulnerability. The specific flaws will keep changing. The structural problem will not.

What separation looks like in practice

The fix is not a better corporate VPN. It is keeping your personal life off corporate infrastructure entirely.

Your banking logins, personal email, streaming accounts, and everything else tied to your identity should travel through a path you control. A home IP setup gives you that: your traffic exits through your own residential connection, so no gateway vulnerability on someone else’s appliance can intercept it, and no forged session can impersonate you.

This is not about distrusting your employer. It is about recognizing that their security perimeter protects the company, not you. Two zero-day chains in two weeks prove the point more clearly than any advice column could.

Frequently asked questions