By Thomas Anderson in Security News — 13 Oct 2026

Three Chained Ivanti Connect Secure Zero-Days Gave Attackers Root on a Fully Patched VPN Appliance — Volexity Says Only Two of the Flaws Have Fixes So Far

Volexity has disclosed an attack in which a threat actor it tracks as UTA0576 chained three zero-day vulnerabilities in an Ivanti Connect Secure (ICS) VPN appliance to achieve unauthenticated root-level code execution — on a device that was fully patched at the time, running version 22.8R2.4. The actor began exploiting the chain on October 3, and telemetry from Defused Cyber caught pre-disclosure exploitation as early as October 1. Ivanti released fixes for the first two flaws on October 13 and says it is aware of "limited exploitation in the wild," urging customers on affected versions to "act immediately." The third flaw — the privilege escalation — remains unpatched, with a fix expected in a future release in the coming weeks.

The chain works in three steps. An authentication bypass in the welcome.cgi endpoint lets requests route to arbitrary CGI files, including authenticated ones. A file-write RCE in wu.cgi follows: the actor uploads a Perl script with a .zip extension, which executes a Bash script that in turn runs a Python payload as the cgi-server user. The first two flaws are tracked together as CVE-2026-104935 (CVSS 8.6), affecting Connect Secure 22.8R2.4 and prior, 25.1.1.1 and prior, and 25.1.2.2 and prior. The privilege escalation then targets dsinvoked, a privileged service that runs maintenance tasks as root: the exploit patches the cgi-server process's in-memory copy of an Ivanti library, reconfigures an existing maintenance task to launch the Perl interpreter with a malicious script, and confirms root by checking whether /etc/shadow is readable.

What makes the attack hard to catch is the anti-forensics. The actor deleted evidence from Ivanti debug logs and Linux audit logs, passed commands and results through the exploit chain's own HTTPS requests — no separate command-and-control channel, no web shell, no backdoor — and after each privilege escalation restored the in-memory library and configuration data to their pre-exploitation state. That is why Ivanti's Integrity Checker Tool (ICT) misses this compromise: nothing on disk stays altered. Volexity says confirming compromise requires network and memory forensics, and lists concrete indicators: large numbers of requests to /dana-na/auth/url_default/welcome.cgi, an X-DSCGI-PATH header value that doesn't match the URL path, the /data/.icscap/ directory, and the IP 108.165.147[.]64 used in the investigated incident.

After gaining root, UTA0576 stole stored credentials — including LDAP domain credentials used by the appliance — dumped and exfiltrated limited Active Directory metadata, and deployed custom Kerberos Kerberoasting and LDAP search tools. Volexity assesses with low confidence that the motive is criminal rather than espionage. CISA added CVE-2026-104935 to its KEV catalog on October 13 with a federal deadline of October 16, and Previdian reported 105 exploitation attempts against its honeypot sensors by October 14, warning that "full weaponized exploitation is likely to follow."

What Should You Do?

Update now — move affected Connect Secure appliances to the October 13 fixes (22.8R2.5, 25.1.3.0 or later) immediately; the KEV clock for federal agencies runs out October 16, and no temporary workaround has been named.
Hunt beyond the ICT — the Integrity Checker Tool cannot see this chain. Check for welcome.cgi request bursts, mismatched X-DSCGI-PATH headers, and the /data/.icscap/ directory, and be ready to do memory and network forensics.
Rotate every credential the appliance ever held — stored LDAP and domain credentials must be considered stolen, from service accounts to bind passwords.
Assume root remains possible — until the privilege-escalation fix ships, even a patched appliance can be rooted if CVE-2026-104935 exploitation succeeds; keep management access segmented and monitor aggressively.

The WAF Angle

This story keeps repeating because VPN appliances are the perfect target: pre-authenticated edge devices that hold credentials for everything behind them. Volexity's HTTPS-embedded command channel is the detail worth internalizing — traffic to the appliance's own VPN port looks exactly like legitimate sessions, so egress filters waiting for a "C2 connection" never fire. Defense has to come from credential hygiene (appliances should not store reusable domain credentials), appliance-aware monitoring (request-shape anomalies at the edge), and the recognition that SSL-VPN credential campaigns like FortiBleed and appliance zero-day waves like NetScaler's are feeding the same pipeline. A WAF in front of published VPN portals won't stop exploit chains inside the appliance — but tight egress rules, session anomaly detection, and fast patching on edge infrastructure will. This is the second week in a row that the most urgent patch in security lives on an edge box, not a server.

Three Chained Ivanti Connect Secure Zero-Days Gave Attackers Root on a Fully Patched VPN Appliance — Volexity Says Only Two of the Flaws Have Fixes So Far