Ivanti Connect Secure Zero-Day Chain, Exploited (CVE-2026-104935)

TL;DR

• A three-flaw chain gives an unauthenticated attacker root command execution on Ivanti Connect Secure VPN appliances. Volexity documented the chain and the actor it tracks as UTA0576 on October 13, 2026.
• Ivanti Connect Secure appliances on the affected lines are exposed if an attacker can reach the web interface, because the entry point needs no credentials and no user interaction.
• Exploited in the wild since October 2026. CISA KEV-listed all three chain CVEs on 2026-10-13, 2026-10-30 and 2026-10-30; the federal deadlines are 2026-11-02 and 2026-11-13 for the newest two.
• Upgrade to 22.8R2.6 on the 22.8R2 line or 25.1.1.3 on the 25.1.1 line, then hunt for compromise with the checks in "How do I fix it?" and "How do I check if I was compromised?".

Am I affected?

All of these conditions must hold:

• You operate an Ivanti Connect Secure appliance, physical, virtual, or cloud, whose web interface an attacker can reach over the network.
• The appliance runs an affected version: 22.8R2.5 and prior on the 22.8R2 line, or 25.1.1.2 and prior on the 25.1.1 line, for the October 29 fixes. CVE-2026-104935 alone also affects 25.1.1.1 and prior and 25.1.2.2 and prior.
• No credential is needed to start the chain, and no user on your side interacts with anything. The actor Volexity observed exploited a fully patched 22.8R2.4 appliance, the latest version on that line at the time.

The fixed-version rows come from Ivanti's advisory as quoted by The Hacker News on October 31, 2026, and from the CVE records. In the sources available, the 25.1.2 row is affected only by CVE-2026-104935. Readers on that line and on the 25.1.3 train should follow Ivanti's upgrade and migration compatibility guide, which CISA's October 13 alert links. The CVE record for CVE-2026-104935 also states that 22.7R2.14 and prior are not impacted by that flaw.

Ivanti Connect Secure is an enterprise VPN appliance at the network edge. Its exposure and stored credentials make it a valuable target.

To check the installed version, read it in the Connect Secure admin console dashboard and compare it with the table. The dashboard reports the version of the appliance you are logged into, so repeat it per appliance or per cluster member.

How do I fix it?

1. Upgrade every affected appliance to 22.8R2.6 or later on the 22.8R2 line, or 25.1.1.3 or later on the 25.1.1 line. The October 13, 2026 patches fixed CVE-2026-104935, and the October 29, 2026 patches fixed CVE-2026-111357 and CVE-2026-118527.
2. Appliances on the 22.8R2 line reach end of life on January 31, 2027, per CISA's October 13 alert. Plan the migration to a supported line now rather than patching the old one repeatedly.
3. Treat the upgrade as a compromise response, not only a patch. CISA's October 13 alert sets out the response steps for organizations that find compromise. If compromise is suspected, preserve volatile memory, disk and network evidence with your incident-response team before a reset or upgrade destroys it. Back up the configuration, factory reset or rebuild the appliance, upgrade it, and restore the configuration. Then reset every password, stored certificate, API key and license credential.

Ivanti's advisory lists no workaround, because the entry point is the public login page that a VPN must expose. Volexity recommends a temporary detection control: watch for large numbers of requests to /dana-na/auth/url_default/welcome.cgi that carry an X-DSCGI-PATH header. Also alert on mismatches between the URL path and that header. This control only covers the known entry paths, so it cannot replace the upgrade.

What is the root cause?

The chain works because three independent trust decisions line up. The appliance routes a request by a header the client controls. An upload handler writes a file before validating it. A root service trusts a configuration store that a compromised process can edit. Volexity reconstructed all three from memory and core-dump forensics, because UTA0576 deleted the appliance's own logs.

1. Authentication bypass. A request to /dana-na/auth/url_default/welcome.cgi, the public login page, is allowed without authentication. The request carries a header X-DSCGI-PATH: /home/webserver/htdocs/dana/fb/smb/wu.cgi, which names an internal CGI script that runs in a trusted context. The appliance uses the URL to decide whether the request is allowed, but the header to decide where it goes.

2. Remote code execution. The upload handler in wu.cgi accepts a Perl script named with a .zip extension. It calculates the MD5 hash of the client-supplied filename and writes the uploaded content to /home/runtime/tmp/<MD5(filename)>. Only after writing the file does the handler check that it is a valid ZIP and delete it. In the short window before deletion, the attacker sends parallel requests whose X-DSCGI-PATH header points at the uploaded path, and the script executes as the cgi-server user.

3. Privilege escalation to root. The appliance runs dsinvoked, a privileged background service that runs maintenance tasks as root. It looks up each task's program in DSCache, a shared configuration store. The attacker's code patches its own in-memory copy of the Ivanti library /home/lib/libdsplibs.so so it can modify DSCache. It then reconfigures an existing maintenance task to launch the Perl interpreter instead of /home/bin/updateOpswatSDK.pl. When dsinvoked runs the task, the attacker's script executes as root, and the exploit confirms it by reading /etc/shadow.

After each command, the payload restores the DSCache entry and restores the library patch through /proc/self/mem. It also removes the matching entries from /home/runtime/dlogs/debuglog and /var/log/audit/audit.log. Ivanti tracks the first two flaws under CVE-2026-104935, and the privilege escalation is CVE-2026-111357. CVE-2026-118527 covers the predictable file location that tells the attacker where the upload lands.

How is it exploited?

1. The attacker, needing no credentials, sends a request to the public login script /dana-na/auth/url_default/welcome.cgi with X-DSCGI-PATH set to wu.cgi.
2. Through that trusted route, the attacker uploads a Perl script whose filename ends in .zip, so the handler writes it to the predictable /home/runtime/tmp/<MD5(filename)> path.
3. Before the handler's ZIP validation deletes the file, parallel requests reach the uploaded path through the same header trick and execute it as cgi-server.
4. The Perl stage runs a Bash script, which decodes and executes a Base64-encoded, zlib-compressed Python script in memory, so the raw script is never written to disk.
5. The Python stage patches the in-memory library, redirects the maintenance task in DSCache, and asks dsinvoked to run it, which executes as root.
6. Every command the attacker runs re-executes the whole chain, and its result returns inside the HTTP response; Volexity found no persistent web shell or backdoor in this incident.

Volexity observed UTA0576 run this chain repeatedly from October 3, 2026. The steps above describe its published analysis of recovered payloads; Volexity did not identify a persistent web shell or backdoor in that investigation.

How does the attack flow?

An unauthenticated request that reuses the login page's trust reaches an internal upload handler, wins a deletion race, and escalates through a root service to full control of the appliance.

What can an attacker do?

The chain yields unauthenticated root-level command execution on the appliance, with full read, write and availability impact on it. Ivanti's CVE record rates CVE-2026-104935 at CVSS v3.1 8.6, CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L. The privilege escalation alone is CVSS v3.1 7.0, CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H per its record, because in isolation it needs a foothold on the appliance.

With root, UTA0576 did the following, all documented by Volexity:

• Extracted credentials stored on the appliance, including the domain credentials it uses for LDAP.
• Dumped and exfiltrated limited Active Directory metadata, and queried the directory through the appliance's own service account.
• Deployed a custom Kerberos tool with Kerberoast capability, and a custom Python LDAP tool that searched for LAPS local administrator passwords, BitLocker recovery keys, and password-bearing user attributes.
• Ran password spraying, parsed local authentication logs for valid usernames, and captured LDAP traffic from the appliance to harvest plaintext credentials and NTLM hashes.
• Exfiltrated the appliance configuration, including its authentication methods, and conducted local DNS and host reconnaissance.

The conditions are narrow and favorable to the attacker: network reachability to the web interface is the only prerequisite. Volexity assesses with medium confidence that UTA0576 used large language models to help develop the chain, and with low confidence that its motives are criminal rather than espionage. Volexity disrupted the operation it observed, so the ultimate objective remains unknown.

Why does the fix work?

The October 13, 2026 patch closes the entry point. After it, the request-routing flaw that let a public URL reach internal CGI scripts through the X-DSCGI-PATH header no longer works, so the upload and execution stages cannot start. Ivanti's code changes are not public, so this cannot be verified against a diff. The October 29, 2026 patch fixes CVE-2026-111357, closing the route from a compromised process to root through DSCache. It also fixes CVE-2026-118527, the predictable upload location.

Ivanti stated that it found part of the flaw internally and patched it in the July 2026 release 25.1.3.0, and was backporting the fix when the exploitation occurred. The company explained that it shipped the CVE-2026-104935 fix first because that flaw was the primary exploitation path. The privilege escalation therefore remained unpatched on the 22.8R2 line for the 16 days between October 13 and October 29, 2026. Appliances patched on October 13 were protected against the remote entry point, but any other code-execution foothold could still have escalated to root in that window.

How do I check if I was compromised?

Start with HTTP telemetry that records request headers, such as existing proxy or network captures. Standard appliance access logs may not retain X-DSCGI-PATH; exporting them does not guarantee that these searches can detect the chain. The examples below apply to uncompressed text logs containing headers and are adapted from Volexity’s monitoring guidance:

grep -ai "X-DSCGI-PATH" *.log* | grep -a "welcome.cgi"

grep -a "X-DSCGI-PATH: /home/webserver/htdocs/dana/fb/smb/wu.cgi" *.log*
grep -a "X-DSCGI-PATH: /home/runtime/tmp/" *.log*

A match identifies a suspicious request, not proof that routing or execution succeeded. Investigate it alongside other evidence. Repeated requests to /dana-na/auth/url_default/welcome.cgi from one source are another lead.

Then look for the post-exploitation artifacts Volexity recovered, on every appliance:

ls -la /tmp/        # ml.py, rq5.py, mk.py, rr.py, sp_run.py, sp_out.txt, spray_hits.json
ls -la /data/.icscap/   # h.py, dsstatmond, cap0–cap7

The actor's operation host observed by Volexity was 108.165.147[.]64. Previdian's honeypots recorded 105 attempts from 50 addresses by October 14, 2026, including 216.73.160[.]59, 216.73.160[.]61, 216.73.160[.]210 and 45.8.19[.]111.

Two limits on these checks matter. The payload deletes its own entries from the appliance's debug and audit logs, so clean logs do not prove safety. Ivanti’s Integrity Checker Tool cannot rule out this exploitation: the library patch is in memory and the DSCache change is restored. Temporary payloads and post-exploitation tools can still touch disk. Volexity and CISA both state that confirming compromise requires network and memory forensics. CISA's full response steps are in "How do I fix it?".

Timeline

• 2026-10-01: Defused Cyber records pre-disclosure exploitation attempts against its decoys, which it assesses as CVE-2026-104935.
• 2026-10-03: UTA0576 begins repeatedly exploiting the chain against a Volexity customer's appliance, running the then-latest 22.8R2.4 build 19097.
• 2026-10-05: Volexity begins the investigation that reconstructs the chain from memory and core dumps.
• 2026-10-13: Ivanti releases fixes for CVE-2026-104935, Volexity publishes the chain analysis, and CISA adds the flaw to KEV with a due date of 2026-10-16.
• 2026-10-14: Previdian reports 105 exploitation attempts from 50 IP addresses against its honeypot sensors.
• 2026-10-15: The CVE record for CVE-2026-111357 is published by MITRE, stating the flaw was exploited in the wild.
• 2026-10-29: Ivanti publishes patches for CVE-2026-111357 and CVE-2026-118527 in 22.8R2.6 and 25.1.1.3.
• 2026-10-30: CISA adds both chain CVEs to KEV, with federal due dates of 2026-11-02 and 2026-11-13.

FAQ

Does an internal-only appliance need the fix?

Yes, if any network attacker can reach its web interface, including through a jump host network or a misconfigured exposure. The chain's first request goes to the public login page, so it needs no VPN account and no prior access. If the interface is genuinely unreachable, the risk drops to insiders and pivoted attackers, and the upgrade remains the fix.

I patched for CVE-2026-104935 on October 13. Am I done?

Only if you have since reached 22.8R2.6 or 25.1.1.3. The October 13 patch closed the remote entry point, but the privilege escalation stayed unpatched until October 29. Verify the version, complete the upgrade, and remember that any other code-execution foothold on the appliance could have escalated during that window.

Can the Integrity Checker Tool confirm the appliance is clean?

No. The exploit patches library code in memory only and restores the configuration store, so a clean integrity-check result cannot exclude compromise. Volexity states that confirming compromise needs memory, disk and network forensics. It also notes that UTA0576 deleted its entries from both the Ivanti debug log and the Linux audit log.

Why do I see a different score for CVE-2026-111357?

The CVE record published by MITRE, last updated October 31, 2026, rates it CVSS v3.1 7.0 with the vector above. Some coverage published on October 31 reports 8.8 for the same flaw. The post follows the CVE record as the primary source, and the record is also what CISA's enrichment data builds on. The score only matters in isolation, because the chain's entry point needs no credentials at all.

Was this ransomware or espionage?

Neither is confirmed. Volexity assesses with low confidence that UTA0576 is criminally motivated, and the observed actions were preparation for lateral movement: credential theft, Active Directory reconnaissance and password spraying. The operation Volexity observed was disrupted before its final objective, which remains unknown.

What is the relationship between the three CVEs?

CVE-2026-104935 covers the authentication bypass and the code-execution race together. CVE-2026-111357 covers the escalation to root, and CVE-2026-118527 covers the predictable file location that makes the upload land at a known path. CISA's KEV entries for the last two state that each chains with the other two. The CVE record for CVE-2026-118527 was not yet published as of October 31, 2026.

How widespread is exploitation?

No victim count is published. Defused Cyber recorded attempts from October 1, and Previdian counted 105 attempts against its sensors by October 14. The watchTowr consultancy told The Hacker News that this flaw joins 14 other Ivanti and Pulse Connect Secure entries in the KEV catalog. Attempts are confirmed; the number of successful compromises is not.

Find the exposed VPN appliances in your estate with Ostorlab

An internet-reachable appliance is the only precondition this chain needs. Ostorlab's attack surface discovery inventories the internet-facing hosts in your organization. It tells you which Ivanti Connect Secure appliances exist and where to check versions first.

References

• Volexity, A Series of Unauthenticated Events: Chained Exploitation of Ivanti Connect Secure Zero-Days: https://www.volexity.com/blog/2026/10/13/a-series-of-unauthenticated-events-chained-exploitation-of-ivanti-connect-secure-zero-days/ (checked October 31, 2026)
• Volexity threat intelligence indicators for the UTA0576 campaign: https://github.com/volexity/threat-intel/tree/main/2026/2026-10-13%20Ivanti (checked October 31, 2026)
• Ivanti security advisory, CVE-2026-104935: https://hub.ivanti.com/s/article/Security-Advisory-Ivanti-Connect-Secure-CVE-2026-104935 (checked October 31, 2026)
• CVE-2026-104935 record: https://www.cve.org/CVERecord?id=CVE-2026-104935 (checked October 31, 2026)
• CVE-2026-111357 record: https://www.cve.org/CVERecord?id=CVE-2026-111357 (checked October 31, 2026)
• CISA alert, CISA Adds Two Known Exploited Vulnerabilities to Catalog, October 30, 2026: https://www.cisa.gov/news-events/alerts/2026/10/30/cisa-adds-two-known-exploited-vulnerabilities-catalog (checked October 31, 2026)
• CISA Known Exploited Vulnerabilities catalog JSON feed: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json (checked October 31, 2026)
• The Hacker News, Attackers Chain Three Ivanti Connect Secure Flaws to Gain Unauthenticated Root Access, October 31, 2026: https://thehackernews.com/2026/10/attackers-chain-three-ivanti-connect.html (checked October 31, 2026)
• The Hacker News, CISA Urges Immediate Ivanti Connect Secure Updates as Honeypots Log 105 Exploit Attempts, October 14, 2026: https://thehackernews.com/2026/10/cisa-urges-immediate-ivanti-connect.html (checked October 31, 2026)
• CISA alert, CISA Urges Patching of Newly Exploited Ivanti Connect Secure Vulnerability, October 13, 2026: https://www.cisa.gov/news-events/alerts/2026/10/13/cisa-urges-patching-newly-exploited-vulnerability-ivanti-connect-secure (linked from The Hacker News, checked October 31, 2026)