Exploited in the wildHIGHCISA KEV

Ivanti Connect Secure auth bypass exploited as zero-day, chained to root on patched VPNs

An unauthenticated bypass and code execution flaw in Ivanti Connect Secure was exploited before the 2026-10-13 fix. Upgrade now; Volexity and CISA warn Ivanti's Integrity Checker Tool may miss this intrusion, so hunt with forensics.

Ivanti Connect SecureCVE-2026-104935CVSS8.6CWE-290Edge & VPN
Published Oct 22, 2026 · Updated Oct 22, 2026

Exploited before disclosure: Defused saw attacks from 2026-10-01, Volexity investigated a UTA0576 intrusion that began 2026-10-03, Ivanti confirms a limited number of affected customers, and CISA added the CVE to KEV on 2026-10-13 1,3,4.

Jun 1, 2026137 daysOct 16, 2026

What you need to know

  • Affects Ivanti Connect Secure 22.8R2.4, 25.1.1.1 and 25.1.2.2 and earlier on each line; 22.7.x is not affected.
  • A remote attacker with no credentials can bypass authentication and run commands on the appliance; chained with an unpatched privilege escalation it reaches root.
  • Exploited before fixes existed for most lines, since at least 2026-10-01 per Defused; Volexity attributes the intrusion it investigated to UTA0576; CISA KEV since 2026-10-13.
  • Upgrade to 22.8R2.5, 25.1.1.2 or 25.1.3.0/25.1.3.1. The privilege escalation flaw in the chain had no fix at disclosure; Ivanti said one would follow in the coming weeks.
  • Alert on requests to welcome.cgi carrying an X-DSCGI-PATH header; Volexity and CISA say the Integrity Checker Tool may not detect compromise, so do not rely on it alone.

What's happening

CVE-2026-104935 is an authentication bypass by spoofing in Ivanti Connect Secure (ICS) that lets a remote, unauthenticated attacker execute arbitrary commands on the gateway 2. Ivanti tracks both the bypass and the follow-on remote code execution step under this single CVE, rated CVSS 8.6 2,8. Affected releases are 22.8R2.4, 25.1.1.1 and 25.1.2.2 and earlier on their respective code lines, while 22.7.x and older do not contain the flaw 2.

Volexity found the bug while responding to an intrusion at a customer whose ICS 22.8R2.4 appliance was fully patched at the time; the actor, which Volexity tracks as UTA0576, began exploiting it on 2026-10-03 1. Defused reported earlier exploitation on its decoys starting 2026-10-01 4, and a Volexity researcher said activity in late September would not be surprising 9. Ivanti's advisory says it was aware of exploitation affecting "a limited number of customers" at disclosure 3. CISA added the CVE to its Known Exploited Vulnerabilities catalog on 2026-10-13 with a federal due date of 2026-10-16 4,7,8.

Volexity observed credential theft from the appliance, Active Directory reconnaissance, hunting for LAPS passwords and BitLocker recovery keys, password spraying and LDAP traffic capture, with no web shell or persistent malware 1. It assesses with low confidence that UTA0576 has criminal rather than espionage motives, and says the activity pointed to preparation for lateral movement, though the actor's end goal could not be determined 1. After disclosure, Previdian honeypots logged 105 exploit attempts from 50 IP addresses by 2026-10-14, mostly probing whether code execution worked 5. Shadowserver tracks roughly 5,500 to 5,600 internet-exposed ICS instances 4,6.

How it works

The bypass is a path confusion between access control and request routing. A request to the public welcome.cgi endpoint passes the authorization check, which looks at the URL path, but an internal routing header, X-DSCGI-PATH, steers the request to a protected CGI script 1. A watchTowr researcher said one crafted request is enough to get past authentication 5.

Code execution comes from the wu.cgi upload handler, which writes a file to disk before checking that it is a ZIP archive, leaving a short window in which the attacker can execute it before it is deleted 1. A watchTowr researcher said the race condition this requires offers little resistance 9.

UTA0576 completed the chain with a third, separate flaw: the root-level dsinvoked broker trusts configuration data in DSCache, which the actor abused by patching a library in memory to have a maintenance task run its code as root 1. At disclosure on 2026-10-13 that privilege escalation had no CVE and no fix; Ivanti planned one in the coming weeks 3. Ivanti says it first found part of the defect internally in June 2026 9, fixed that portion in the July release 25.1.3.0, and was backporting the fix to other supported versions when exploitation began 8.

What to do

In order of priority
  1. 1

    Upgrade to the fixed release for your code line: 22.8R2.5, 25.1.1.2, or 25.1.3.0/25.1.3.1 2. Rapid7 recommends doing this outside normal patch cycles 2.

  2. 2

    Note that 25.1.3.0 needs ISA4500, ISA6500 or ISA8500 hardware or a rebuilt virtual or cloud appliance; sites that cannot migrate yet can use the 22.8R2.5 or 25.1.1.2 interim fixes 10. No workaround has been described 10.

  3. 3

    Plan off the 22.8 line, which reaches end of life on 2027-01-31 5.

  4. 4

    Restrict network access to the appliance's management and gateway interfaces where possible, as watchTowr advises 10, since the privilege escalation step in the chain was unpatched at disclosure 3.

  5. 5

    If compromise is suspected, follow CISA's recovery steps: back up the configuration, factory reset and upgrade (or rebuild virtual and cloud instances), restore the configuration, then reset all passwords, revoke and reissue certificates, and reset API keys and license server credentials 5.

  6. 6

    Because the actor harvested LDAP service account credentials and AD secrets, rotate the appliance's directory service accounts and review LAPS and BitLocker recovery key exposure on any compromised device 1.

Detection

  • In web and load balancer logs, alert on requests to /dana-na/auth/url_default/welcome.cgi that carry an X-DSCGI-PATH header, and on any mismatch between the URL path and that header; Volexity expects other entry paths to surface 1.
  • Watch for bursts of requests to welcome.cgi, which Volexity saw during repeated exploitation 1.
  • On suspect appliances, look for a hidden /data/.icscap/ directory, a process named dsstatmond (a renamed tcpdump), Python scripts in /tmp, and ics-root-run-inband-*.pl files under /home/runtime/tmp 1.
  • Run Ivanti's Integrity Checker Tool regularly as Ivanti recommends 3, but treat a clean result as inconclusive: Volexity found the tool detected no changes because the chain patches memory and restores configuration data, and CISA also warns it may miss exploitation; both call for network and memory forensics 1,4.
  • Look downstream for the post-exploitation pattern: LDAP binds with the appliance's service account, AD queries for LAPS and BitLocker attributes, Kerberoasting and password spraying originating from the VPN appliance 1.
  • Validate exposure with authenticated scanning; Rapid7 shipped a vulnerability check in its 2026-10-14 content release 2.

Indicators

As published by the cited sources
TypeValueContext
ip108.165.147[.]64UTA0576 VPS (Evoxt) per Volexity; defanged as published1
url path/dana-na/auth/url_default/welcome.cgiLegitimate endpoint; suspicious with an X-DSCGI-PATH header1
file path/data/.icscap/Hidden staging directory with capture files1
otherdsstatmondProcess name of a renamed tcpdump used for LDAP capture1
file path/home/runtime/tmp/ics-root-run-inband-*.plRoot execution scripts from the privilege escalation step1
file path/home/runtime/tmp/ics-root-result-inband-*Output of root execution1
file path/tmp/ml.pyPost-exploitation script1
file path/tmp/mk.pyPost-exploitation script1
file path/tmp/rq5.pyPost-exploitation script1

Timeline

  1. Ivanti's internal checks find part of the defect (June 2026; day not reported) 9

  2. Ivanti fixes part of the defect in ICS 25.1.3.0 (July 2026; day not reported) 8

  3. UTA0576's VPS starts running an OpenVPN server 1

  4. Defused reports first exploitation on its decoys 4

  5. UTA0576 begins exploiting the Volexity customer's appliance 1

  6. Volexity opens its investigation 1

  7. Ivanti publishes advisory and fixes; Volexity publishes analysis; CISA adds the CVE to KEV 4

  8. Previdian reports 105 exploit attempts from 50 IPs on honeypots 5

  9. CISA KEV remediation deadline for federal civilian agencies 7

Sources

  1. 1
    A Series of Unauthenticated Events: Chained Exploitation of Ivanti Connect Secure Zero-Days
    Volexity · Research · Oct 13, 2026
  2. 2
    Ivanti Connect Secure zero-day exploited in the wild (CVE-2026-104935)
    Rapid7 · Research · Oct 13, 2026
  3. 3
    Ivanti patches Connect Secure zero-day after researchers confirm in-the-wild attacks
    The Register · News · Oct 14, 2026
  4. 4
    CISA warns admins to immediately fix Ivanti flaw exploited as zero-day
    BleepingComputer · News · Oct 14, 2026
  5. 5
    CISA Urges Immediate Ivanti Connect Secure Updates as Honeypots Log 105 Exploit Attempts
    The Hacker News · News · Oct 14, 2026
  6. 6
    Ivanti warns of Connect Secure zero-day exploited in attacks
    BleepingComputer · News · Oct 13, 2026
  7. 7
    Attackers chained three Ivanti zero-days to gain root on fully patched VPN appliances
    Help Net Security · News · Oct 14, 2026
  8. 8
    Ivanti Zero-Day Attacks Highlight Vendor Patching Hurdles
    Dark Reading · News · Oct 14, 2026
  9. 9
    Ivanti misses opportunity to fix vulnerability before attackers got to work and made it a zero-day
    CyberScoop · News · Oct 13, 2026
  10. 10
    CVE-2026-104935: Ivanti Connect Secure Vulnerability
    watchTowr · Research · Oct 13, 2026

Corroborated by independent sources. Researched and drafted by the VulnDigest briefs agent from 10 sources, then checked against them by a separate review step on Oct 22, 2026.

Ivanti's advisory and CISA's KEV pages could not be loaded; affected and fixed versions come from Rapid7's and watchTowr's reproductions of the advisory and match BleepingComputer's list of fixed builds.

Exploitation evidence is from Volexity's incident response and Defused's decoys; the KEV date is as reported by news coverage.

Ivanti fixed part of the defect in 25.1.3.0 in July 2026, but other code lines had no fix when exploitation began.

The privilege escalation flaw in the chain had no CVE or fix at disclosure on 2026-10-13.

Spotted an error? Open an issue on sochub.io.