Ivanti Connect Secure: zero-day chain exploited for root access, one of three flaws still unpatched

Attackers chained three unknown flaws in Ivanti Connect Secure VPN appliances to run commands as root without logging in, then harvested Active Directory credentials. Ivanti fixed two of them on 13 October (CVE-2026-104935); the privilege escalation remains open.

What happened

On 13 October 2026, Ivanti disclosed CVE-2026-104935 in its Connect Secure VPN appliance and said it was aware of limited exploitation in the wild. The same day, CISA added the flaw to its catalogue of exploited vulnerabilities and gave US federal agencies until 16 October to act. The flaw was reported by Volexity, which says it found an exploit chain while investigating a customer intrusion that began on 3 October.

According to Volexity, the chain combines three weaknesses: an authentication bypass in welcome.cgi, a file write leading to remote code execution, and a privilege escalation to root. The first two are covered by CVE-2026-104935 (CVSS 8.6) and are fixed. The privilege escalation has no fix yet; Volexity expects it in a release in the coming weeks.

What the attackers did

Volexity tracks the actor as UTA0576. It did not drop a web shell or backdoor: it used the appliance to collect credentials. Its tools queried Active Directory over LDAP, ran Kerberoasting, sprayed passwords and captured network traffic to pull out plaintext LDAP, HTTP Basic and NTLM logins. It also went after LAPS passwords, BitLocker recovery keys and the VPN configuration. Because the changes lived in memory, Volexity warns that Ivanti's Integrity Checker Tool may not reveal a compromise.

What to do now

1. Check your version. According to NVD, branches 22.8R2 to 22.8R2.4 and 25.1 before 25.1.3.0 are affected; 22.7R2.14 and earlier are not.
2. Upgrade now to 22.8R2.5 or to 25.1.3.0 / 25.1.3.1, following Ivanti's advisory.
3. Search your logs for bursts of requests to /dana-na/auth/url_default/welcome.cgi carrying an X-DSCGI-PATH header, and look for unexpected files in /tmp/. Do not rely on the Integrity Checker alone.
4. If the appliance was exposed since early October, treat it as a possible intrusion: change the passwords of the AD service accounts used by the VPN and of accounts with an SPN, rotate LAPS passwords and BitLocker keys, and watch for password spraying.
5. Apply the third fix as soon as Ivanti releases it.

Our take

A VPN gateway sees every password that passes through it, which makes it the ideal place to steal a whole directory without touching a workstation. Patching closes the door, but credentials taken before the patch stay valid until you change them: plan that rotation as part of the response, not as an option.

Sources

• Ivanti — October 2026 Security Update
• Volexity — A Series of Unauthenticated Events: Chained Exploitation of Ivanti Connect Secure Zero-Days
• CISA — Known Exploited Vulnerabilities Catalog: CVE-2026-104935
• NIST NVD — CVE-2026-104935

How we choose, verify and write our analyses →