Ivanti Connect Secure Zero-Day Chain Gave Root on a Patched VPN, and the Integrity Checker Misses It

An unauthenticated remote attacker can run commands as root on an Ivanti Connect Secure VPN appliance by chaining three zero-days, provided the appliance runs a build before the October 13 fixes (Volexity saw it work against a customer's appliance on 22.8R2.4, which was the latest patched build at the time). Ivanti has fixed two of the flaws under CVE-2026-104935. The third, a privilege escalation to root, has no CVE and no fix in any source reviewed.

The timeline matters more than the score here. Volexity says the attacker it tracks as UTA0576 began exploiting the chain on 3 October; Ivanti published its advisory and CISA added CVE-2026-104935 to its Known Exploited Vulnerabilities catalog on 13 October. That is ten days of exploitation before any public guidance.

What CVE-2026-104935 covers, and what it does not

The Hacker News, summarising Volexity's report, says the CVE bundles an authentication bypass and a remote code execution flaw. Together they let an attacker run code as the appliance's cgi-server user. Ivanti rates the CVE 8.6 out of 10.

The third flaw raises that access to root. Volexity says Ivanti will fix it "in a future release in the coming weeks." Volexity's report does not say what risk the flaw poses once the first two are patched, according to The Hacker News.

The score understates the practical risk, because the 8.6 describes the two fixed flaws, not the chain that ends in root. Rapid7 classes CVE-2026-104935 as an authentication bypass by spoofing (CWE-290) that lets a remote, unauthenticated attacker execute arbitrary commands.

Which versions are fixed

Branch	Affected	Fixed in
25.1	25.1.1.1 and prior	25.1.1.2
25.1	25.1.2.2 and prior	25.1.3.0, 25.1.3.1
22.8	22.8R2.4 and prior	22.8R2.5

The table follows Rapid7's reading of Ivanti's advisory, which also says 22.7.x and earlier are not affected. The version data in the sources do not fully agree. The CVE record, as summarised by The Hacker News, lists Connect Secure before 25.1.3.0 as affected and 22.7R2.14 or prior as unaffected, and it does not reconcile this with the victim's fully patched 22.8R2.4 appliance.

Rapid7 adds that Ivanti patched part of the flaw in the 25.1.3.0 release in July 2026, and that exploitation happened while backports to other supported versions were still in progress.

What the attacker did, and why the Integrity Checker misses it

Volexity found the activity on a single customer's appliance. The attacker stole stored credentials, including LDAP domain credentials, searched Active Directory for passwords and ran password-spraying attacks. It left no backdoor or web shell and reran the full exploit chain for every command, The Hacker News reports.

The exploit modifies library code only in memory and restores the altered configuration data afterwards. That is why Ivanti's Integrity Checker Tool misses it, and the attacker took steps to avoid the tool as well. Ivanti nonetheless advises running the checker regularly, while Volexity says confirming a compromise needs network and memory forensics.

Volexity assessed with low confidence that the motive is criminal rather than espionage. Ivanti describes "limited exploitation in the wild." Neither company says how many customers were attacked.

Indicators Volexity published

From the one incident it investigated, Volexity lists four indicators:

• A high volume of requests to /dana-na/auth/url_default/welcome.cgi
• An X-DSCGI-PATH header on those requests whose value does not match the URL path
• A directory at /data/.icscap/
• The IP address 108.165.147[.]64

Rapid7 says Ivanti states that reliable indicators of compromise are not available, and that Volexity's list is on its GitHub repository. Rapid7 "strongly recommends" looking for signs of compromise even after patching, and treating the update as an emergency change outside the normal cycle.

What nobody has said

Neither Volexity's report nor Ivanti's post names a temporary workaround for customers who cannot upgrade. Neither says whether upgrading removes access an attacker already holds. Ivanti told customers on affected versions to "act immediately" and to upgrade.

No source reviewed here reports that the root escalation fix has shipped, and the date is the number operators need most. Until Ivanti publishes it, the sources leave open whether an upgraded appliance still lets someone who already has code execution as the cgi-server user reach root.

Operators should upgrade, hunt using Volexity's four indicators and plan for memory forensics rather than trusting a clean Integrity Checker run. The same gap between a fix existing and an operator knowing it matters is documented in the Linux TCP flaw that RHEL and Ubuntu had not patched and GitLab's patch cycle.