By ByteBot
A threat actor chained three vulnerabilities in Ivanti Connect Secure to achieve unauthenticated root-level code execution — on devices that were fully patched when the attacks began. The primary flaw, CVE-2026-104935, carries a CVSS score of 8.6 and allows remote exploitation with no credentials and no user interaction. CISA added it to the Known Exploited Vulnerabilities catalog on October 13 with a federal patch deadline of October 16. If you run ICS in production, your window is today.
One CVE, Three Vulnerabilities
CVE-2026-104935 covers an authentication bypass and a remote code execution bug in Ivanti Connect Secure. But the exploit chain observed in the wild by Volexity adds a third flaw — an unpatched privilege escalation — making the full sequence more damaging than the single CVE number implies.
The chain works like this:
- Authentication bypass — An attacker sends a request to the public-facing welcome.cgi script and supplies an X-DSCGI-PATH header pointing to a protected internal handler. The front-end routing trusts it. The attacker is now speaking directly to scripts that should require authentication.
- Remote code execution — The wu.cgi upload handler writes file content to disk before it validates what was uploaded. Attackers exploit this race window to land a Perl script disguised as a ZIP file. Execution happens before the deletion check runs.
- Privilege escalation to root — The dsinvoked maintenance service can have its configuration manipulated by patching libdsplibs.so in memory. No file is written to disk. The result is root-level code execution from an attacker who started with zero credentials.
That third step has a direct implication for incident response: Ivanti’s built-in Integrity Checker Tool cannot detect in-memory exploits. An ICT scan coming back clean does not mean the device is clean.
What Gets Stolen
Volexity tracked the threat actor UTA0576, a previously undocumented group, exploiting this chain since at least October 3 — ten days before patches were available. The post-exploitation list is extensive: LDAP domain credentials, LAPS passwords, BitLocker recovery keys, Active Directory metadata, Kerberos tickets via Kerberoasting, and captured LDAP network traffic. Authentication logs were selectively deleted to cover the intrusion.
This is not a VPN-scoped incident. Credential theft at this depth means treating it as a domain-wide compromise event, with full password resets and certificate revocations for anything that touched the appliance.
Affected Versions and Patches
| Track | Vulnerable | Fixed |
|---|---|---|
| 22.8.x | 22.8R2.4 and earlier | 22.8R2.5 |
| 25.1 main | 25.1.2.2 and earlier | 25.1.3.0 / 25.1.3.1 |
| 25.1 alt | 25.1.1.1 and earlier | 25.1.1.2 |
The privilege escalation flaw (step three in the chain) is not fixed in the current patches. Ivanti says a fix is coming within weeks. Patching the main CVE is mandatory — it closes the entry point — but it does not eliminate every component the chain exploits.
What to Check If You Were Exposed
If your ICS appliance was reachable between October 1 and October 13, assume potential compromise regardless of ICT results. Specific indicators to hunt:
- HTTP requests to /dana-na/auth/url_default/welcome.cgi with an X-DSCGI-PATH header in web logs
- Gaps or deletions in /home/runtime/dlogs/debuglog and /var/log/audit/audit.log
- Unexplained LDAP queries or anomalous Kerberos activity post-VPN-authentication
- Conduct memory forensics — disk artifacts will have been cleaned by the attacker
Shadowserver currently tracks over 5,500 ICS instances exposed on the public internet. BleepingComputer reports that Previdian honeypots logged 105 exploitation attempts from 50 unique IPs as of October 14, with traffic originating from Singapore and the United States.
The Three-Year Problem
Ivanti Connect Secure has now been exploited as a zero-day in three consecutive years: January 2024, January 2025, and October 2026. The 2024 and 2025 waves involved nation-state actors; UTA0576’s motivations remain unclear, though Volexity assesses criminal over espionage at low confidence.
One additional note from Volexity’s report: they assess with medium confidence that UTA0576 uses large language models for exploit development and post-exploitation activity. That is a notable data point — LLM-assisted attack development shortening the time from vulnerability discovery to weaponized exploit is a threat the industry has anticipated but rarely documented in active campaigns.
This week also saw active exploitation of Palo Alto PAN-OS (CVE-2026-0322) and Cisco appliances, all flagged by CISA simultaneously. Perimeter network devices are the attack surface of the moment. Patch ICS first — the deadline is tomorrow.
