Ivanti Connect Secure Zero-Day Chain Compromises a Patched VPN: What Canadian Security Teams Must Do

What Happened

Volexity reports an attacker it tracks as UTA0576 compromised a fully patched Ivanti Connect Secure appliance running 22.8R2.4. Exploitation began October 3. The chain joins an authentication bypass and remote code execution flaw, CVE-2026-104935, with a privilege escalation flaw. Together they give the attacker root. The Hacker News reports Ivanti rates CVE-2026-104935 at CVSS 8.6 and has fixed the first two flaws. The root escalation fix is still pending and due in a future release.

The attacker left no web shell or backdoor. The exploit changes library code in memory and restores the configuration data it touches. After entry, the attacker stole stored credentials, including LDAP domain credentials, searched Active Directory for passwords, and ran password spraying. Volexity says Ivanti’s Integrity Checker Tool misses this chain.

Why This Matters for Canadian Organizations

Connect Secure sits at the network edge and holds the keys to internal systems. Any Canadian organization running it, from provincial agencies to hospitals to financial firms, faces the same exposure. Stolen LDAP credentials turn one appliance into a path across the whole directory.

The report names no victim count and Ivanti describes limited exploitation. Patching alone does not answer the question of prior compromise. A breach of this kind triggers real-risk-of-significant-harm assessments under PIPEDA, and federally regulated firms answer to OSFI Guideline B-13 on third-party and technology risk. Clean logs from the appliance prove little, because the exploit leaves almost nothing behind.

What to Do

Upgrade to a fixed build as listed in Ivanti’s advisory. The Hacker News notes the version wording is inconsistent, so confirm against Ivanti directly. Hunt for requests to /dana-na/auth/url_default/welcome.cgi with a mismatched X-DSCGI-PATH header, and for the /data/.icscap/ directory and IP 108.165.147[.]64. Run network and memory forensics, since the Integrity Checker will not confirm a compromise. Rotate LDAP and service credentials stored on the appliance and review Active Directory for spraying. Plan for the root fix when Ivanti ships it. See our TechTalk archive and News coverage for related edge device stories.