Ivanti Connect Secure Chain Gives Root on Patched Appliances, and One Link Still Has No Fix

An unauthenticated remote attacker who can reach the web interface of an Ivanti Connect Secure appliance can run commands as root (on 22.8R2.4 and earlier, 25.1.2.2 and earlier, and 25.1.1.1 and earlier, with no credentials and no user interaction). Ivanti published the advisory for CVE-2026-104935 on October 13, 2026, and said it is aware of exploitation against "a limited number of customers" before disclosure.

The remedy is to install a fixed build today and then check the appliance for compromise, because the attacker in the case Volexity documented left no web shell and no backdoor to find.

What the chain does, step by step

Volexity, the security firm that found the activity, published its analysis on October 13. It describes three flaws used together against what it calls fully patched devices.

Step	Component	Effect	Status on Oct. 13
1	welcome.cgi	Authentication bypass through the X-DSCGI-PATH header	Patched, CVE-2026-104935
2	wu.cgi	File write that leaves an uploaded file on disk briefly, so a race condition yields code execution	Patched, CVE-2026-104935
3	dsinvoked	Trusts DSCache configuration data, so commands run as root	No fix; planned for a release in "the coming weeks"

Volexity assigns steps 1 and 2 to the single CVE. The privilege escalation in step 3 has no identifier in the Volexity post.

Rapid7 rates CVE-2026-104935 at CVSS 8.6 and lists the fixed builds as 25.1.1.2, 25.1.3.0, 25.1.3.1 and 22.8R2.5. Rapid7 also says 22.7.x and below are unaffected, citing the vendor advisory.

The score understates the practical position. A rating of 8.6 describes the bypass and file-write pair, and says nothing about the third flaw that turns command execution into root on a box that has just received the first two fixes.

A timeline of 11 days

• September 30 to October 7: an attacker-controlled server at 108.165.147[.]64, a virtual server hosted by Evoxt, runs an OpenVPN service, according to Volexity.
• October 1: Defused observes the first signs of exploitation, as reported by BleepingComputer.
• October 3: Volexity dates repeated exploitation of one appliance from this day.
• October 5: Volexity begins investigating a Network Security Monitoring customer.
• October 13: Ivanti publishes the advisory and patches, and CISA adds the CVE to its Known Exploited Vulnerabilities catalog, per Rapid7.

Ivanti told customers that part of the flaw was found by its own product security program and fixed in release 25.1.3.0 in July 2026. Exploitation took place while the company was backporting that fix to other supported branches, according to Rapid7's summary of the advisory.

What the attacker did after getting in

Volexity tracks the actor as UTA0576, a name it had not used before, and assesses with low confidence that the motive is criminal rather than espionage. It assesses with medium confidence that the actor used a large language model during the intrusion.

On the one customer network Volexity describes, the actor extracted stored LDAP domain credentials, searched Active Directory for LAPS passwords and BitLocker recovery keys, ran a custom Kerberos tool with Kerberoasting functions, and sprayed passwords. It captured LDAP traffic with a renamed tcpdump binary at /data/.icscap/dsstatmond, then deleted scripts and restored in-memory patches.

Commands and output travelled inside the exploit's own HTTPS requests. That is why Volexity says the Ivanti Integrity Checker may not detect a compromise, and why BleepingComputer's account says the actor tampered with logs to evade it.

1. Listed as exploited36 flaws
2. Also used by ransomware gangs12 flaws

Source: BleepingComputer, accessed 2026-10-13

What to do now

Patch to 25.1.1.2, 25.1.3.0, 25.1.3.1 or 22.8R2.5, depending on branch. Then hunt, because patching does not remove an attacker who already holds domain credentials.

Volexity's recommendations include watching for large numbers of requests to /dana-na/auth/url_default/welcome.cgi, comparing the URL path against the X-DSCGI-PATH header, and checking /tmp/ for files such as ml.py and rq5.py. Its indicators are on its GitHub repository under threat-intel/2026/2026-10-13.

BleepingComputer reports that Shadowserver tracks more than 5,500 internet-exposed Connect Secure instances, and says it is unclear how many are honeypots or already secured. Volexity counts one confirmed victim. Neither figure is a measure of how many appliances were hit.

The next milestone is the release that fixes the dsinvoked escalation. Until it ships, root on a patched appliance depends on an attacker finding another way past the first two steps. Related coverage: a CVSS 10.0 SonicWall flaw drew 135 attempts and a Citrix NetScaler zero-day that copied its configuration to a public path.