Ivanti Connect Secure is affected by a high-severity zero-day vulnerability that attackers exploited before its October 13, 2026, disclosure, enabling remote unauthenticated command execution on vulnerable VPN appliances. Ivanti said exploitation affected a limited number of customers, while Volexity linked the activity to a previously unknown threat actor tracked as UTA0576 and found credential theft, Active Directory reconnaissance, and preparation for possible lateral movement.
Key Points
- CVE-2026-104935 allows unauthenticated attackers to execute commands remotely on affected Ivanti Connect Secure appliances.
- Attackers exploited the flaw before disclosure and chained it with a separate privilege-escalation issue to obtain root-level access.
- Volexity observed credential theft, Active Directory searches, password spraying, and collection of network and appliance data.
- Ivanti has released fixes for affected code lines and recommends emergency upgrades, investigation for compromise, and regular integrity checks.
What happened
Ivanti disclosed CVE-2026-104935 in its Connect Secure VPN appliance on October 13, 2026. Ivanti said successful exploitation could allow a remote, unauthenticated attacker to execute arbitrary commands. Rapid7 classified the issue as an authentication bypass by spoofing under CWE-290 and assigned it a CVSS score of 8.6.
Ivanti said: “We are aware of exploitation in the wild affecting a limited number of customers at the time of disclosure.” The company said it was working directly with the affected organizations.
Rapid7 reported that exploitation occurred before public disclosure, making CVE-2026-104935 a zero-day when it was used. Rapid7 also said the Cybersecurity and Infrastructure Security Agency added the vulnerability to its Known Exploited Vulnerabilities catalog on October 13.
Ivanti said its product security program initially found part of the vulnerability and patched that portion in version 25.1.3.0, released in July 2026. The company was working to backport the fix to the remaining supported versions when exploitation occurred.
How the attack worked
Volexity began investigating suspected malicious activity at one of its Network Security Monitoring customers on October 5, 2026. The investigation identified the customer’s Ivanti VPN appliance as the root cause and found that UTA0576 had repeatedly exploited it beginning October 3.
The appliance was running version 22.8R2.4, Build 19097, which Volexity described as fully patched and the latest version available at the time. Ivanti’s advisory identifies 22.8R2.4 and earlier as affected, creating an important distinction between the appliance’s patch status at the time and its exposure to the newly disclosed vulnerability.
Volexity described an exploit chain that combined the authentication bypass and file-write or remote-code-execution components tracked as CVE-2026-104935 with a separate privilege-escalation vulnerability. The chain provided unauthenticated root-level code execution. Ivanti had fixed the authentication-bypass and remote-code-execution components, while Volexity said the privilege-escalation issue remained unpatched and was expected to be addressed in a future release.
The authentication bypass abused how Connect Secure routes requests from front-end and back-end processes to CGI scripts, according to Volexity. The attacker sent requests to the public login path /dana-na/auth/url_default/welcome.cgi while supplying a different script path in the X-DSCGI-PATH header. Volexity said the URL determined whether the request was allowed, while the header path determined its destination, allowing requests to reach a protected CGI script.
For remote code execution, the attacker submitted a Perl script with a .zip extension to the wu.cgi upload handler. The handler wrote the upload to /home/runtime/tmp/<MD5(filename)> before checking whether it was a valid ZIP file, then deleted it when the check failed.
UTA0576 sent parallel requests targeting the temporary file so the script could execute during the short interval before deletion. The Perl script launched a Bash script, which launched a Python script delivered as Base64-encoded, zlib-compressed data. Volexity said the decoded Python script was executed with exec() and remained only in memory.
Volexity said the privilege-escalation step abused the privileged dsinvoked service, which runs maintenance tasks as root and reads task commands from the shared DSCache configuration store. UTA0576 patched the cgi-server process’s in-memory copy of /home/lib/libdsplibs.so, modified DSCache to redirect a maintenance task to the Perl interpreter, and supplied a malicious script for dsinvoked to execute as root.
After checking whether /etc/shadow was readable to verify root access, the attacker restored the in-memory library and the DSCache entry. Volexity also said the actor removed related entries from /home/runtime/dlogs/debuglog and /var/log/audit/audit.log.
Data and network activity
UTA0576 reran the complete exploit chain for each command and returned results through HTTPS responses from the exploit chain rather than using a separate command-and-control channel. Volexity found no first-stage malware, backdoor, or web shell that could execute commands without another exploitation of the appliance.
Volexity reported that the actor extracted credentials stored on the appliance, including LDAP domain credentials, and dumped and exfiltrated limited Active Directory metadata. Custom tools were used to test credentials and search Active Directory for Local Administrator Password Solution credentials, BitLocker recovery information, userPassword and unixUserPassword attributes, logon-script paths, and other account metadata.
The activity also included local DNS and host reconnaissance, collection of Connect Secure configuration and authentication data, inspection of authentication logs, and packet capture and exfiltration of LDAP traffic. A custom LDAP tool authenticated to an internal domain controller using the appliance’s Active Directory service account.
Volexity found a Python script that parsed packet captures for plaintext LDAP credentials, HTTP Basic Authentication credentials, and NTLM challenge-response hashes. The firm also reported that the attacker conducted password-spraying attacks against Active Directory accounts.
Volexity identified 108.165.147[.]64 as infrastructure used in the operation. The host was an Evoxt virtual private server and ran an OpenVPN server from September 30 through October 7, 2026.
Volexity assessed with low confidence that UTA0576’s motivation was criminal rather than espionage. It assessed with high confidence that the activity indicated preparation for lateral movement and a broader compromise, but said the ultimate objectives could not be determined because the operation was detected and disrupted.
Affected versions and fixes
Ivanti identifies versions 25.1.1.1 and earlier in that code line, 25.1.2.2 and earlier in that code line, and 22.8R2.4 and earlier as affected. Ivanti said versions 22.7.14 and lower do not contain the vulnerability.
For version 25.1.1.1 on ISA6000 or ISA8000 appliances, Ivanti directs customers to version 25.1.1.2, released October 5. Version 25.1.3.0, released in July 2026 for ISA4500, ISA6500, or ISA8500 appliances, and later versions do not contain the vulnerability.
For the 22.8 code line, Ivanti recommends moving to version 25.1.1.2 or later. If that migration cannot happen immediately, Ivanti says version 22.8R2.5, released October 12, resolves the vulnerability.
Migration to version 25.1.3.0 requires an ISA4500, ISA6500, or ISA8500 platform. Ivanti said hardware customers need new physical servers, while virtual and cloud customers need to build new devices using the 25.1.3.0 template.
Ivanti said the 22.7 and 22.8 code lines will reach end of life on January 31, 2027, and advised customers to transition to the 25.1 code line before that date.
Detection and response
Ivanti recommends reviewing its advisory, upgrading to a resolved version as soon as possible, and running the Integrity Checker Tool regularly. The company said: “Currently, there are limited indicators of compromise available.” Ivanti directs customers who suspect exploitation to follow its recovery steps.
Rapid7 recommends applying the appropriate update on an emergency basis outside normal patching cycles and looking for signs of compromise even after patching. Customers that suspect exploitation should follow Ivanti’s recovery guidance, Rapid7 said.
Volexity recommends monitoring for large numbers of requests to /dana-na/auth/url_default/welcome.cgi and checking for mismatches between the URL path and the X-DSCGI-PATH header. Requests of interest included the header X-DSCGI-PATH: /home/webserver/htdocs/dana/fb/smb/wu.cgi and requests targeting /home/runtime/tmp/<MD5(filename)> through that header.
Volexity also recommends examining /tmp/ for post-exploitation evidence and conducting network and memory forensics when compromise is suspected. The firm said the attacker’s in-memory library changes and restoration of configuration data meant that the Integrity Checker Tool did not detect modifications associated with the exploit chain, making forensic investigation necessary. Volexity also said the actor selectively removed log entries, deleted temporary scripts and output, restored altered system state, and used a renamed packet-capture executable.
Organizations operating affected Connect Secure versions should apply the relevant Ivanti update, investigate for the credential and Active Directory activity described by Volexity, and continue monitoring after remediation because patching alone may not identify earlier exploitation.
About the Author
