A newly disclosed authentication bypass in Ivanti Connect Secure has already been weaponized against a fully patched appliance, raising fresh alarm about the security of internet-facing remote access infrastructure. The flaw, tracked as CVE-2026-104935, carries a CVSS score of 8.6 and allows unauthenticated attackers to execute commands on vulnerable VPN gateways without credentials or user interaction. Ivanti confirmed limited exploitation in the wild on October 13, 2026, and the Cybersecurity and Infrastructure Security Agency moved quickly to add the bug to its Known Exploited Vulnerabilities catalog.
How the Attack Chain Worked
The incident came to light after Volexity investigated a compromised Ivanti Connect Secure device running version 22.8R2.4 that administrators believed was current on patches. Researchers traced the intrusion to a previously unknown threat actor, designated UTA0576, who combined CVE-2026-104935 with a separate, still-unpatched privilege-escalation zero-day affecting the dsinvoked service. The pairing gave attackers something far more dangerous than ordinary remote code execution: unauthenticated root access to the appliance itself.
The entry point was a routing inconsistency involving the public welcome.cgi endpoint. By sending a crafted X-DSCGI-PATH header, attackers could redirect requests to CGI functionality that should have required authentication, reaching an upload handler called wu.cgi. A malicious Perl script disguised as a ZIP file was briefly written to a temporary directory before the system verified and deleted it. In that narrow window, parallel requests triggered execution of the payload, giving attackers a foothold as the lower-privileged cgi-server account. From there, the second zero-day allowed them to manipulate an in-memory library and a privileged maintenance process to run attacker-controlled code as root.
Why This Intrusion Is Unusually Hard to Catch
What distinguishes this campaign is its restraint. UTA0576 did not install a persistent web shell or backdoor file. Instead, the attackers repeated the entire exploitation sequence each time they needed to issue a command, retrieving output directly through encrypted HTTPS traffic. After each session, they restored modified in-memory configurations and scrubbed relevant entries from debug and audit logs, leaving minimal disk-based evidence.
That approach has direct implications for defenders. Ivanti's Integrity Checker Tool is built to flag unexpected changes to files on disk, but much of this exploit operates in memory and reverses its own tracks. Volexity found the technique capable of evading that safeguard entirely, meaning a clean integrity scan cannot be treated as proof an appliance is untouched. Once inside, the attackers pursued credentials aggressively: extracting stored secrets from the appliance, querying Active Directory, hunting for Windows LAPS passwords and BitLocker recovery keys, spraying passwords, and harvesting LDAP traffic with custom tooling, including Kerberos-focused scripts. Volexity assessed with medium confidence that large language models may have assisted the actor's exploit development, though attribution and motive remain uncertain.
What Organizations Should Do Now
Ivanti has shipped fixes for the authentication bypass and remote code execution components, with patched releases including 22.8R2.5, 25.1.1.2, 25.1.3.0, and 25.1.3.1 depending on the deployed branch. The vendor is urging customers to move toward the 25.x line as the older 22.x code approaches end of life. Crucially, the companion privilege-escalation flaw used in this chain remained unpatched at the time of disclosure, which makes closing the initial entry point through CVE-2026-104935 the only reliable way to prevent attackers from reaching that second vulnerability at all.
- Apply the available Ivanti Connect Secure patches immediately rather than relying on integrity checks alone.
- Monitor for abnormal volumes of requests to the welcome.cgi path, particularly where the X-DSCGI-PATH header references wu.cgi or temporary files under /home/runtime/tmp/.
- Inspect /tmp/ directories for unexplained scripts and review traffic from the VPN appliance toward Active Directory, LDAP, and DNS systems.
- Rotate credentials accessible through the appliance, including LDAP service accounts, following containment.
- Conduct memory and network forensics rather than disk analysis alone, given the attacker's log-scrubbing behavior.
CISA's catalog listing set an October 16 remediation deadline for federal civilian agencies, underscoring the urgency security teams elsewhere should apply voluntarily. Platforms built for rapid detection engineering, such as SOC Prime's AI-Native Detection Intelligence Platform, can help teams translate this threat intelligence into hunting queries and detection logic across SIEM, EDR, XDR, and Data Lake environments, while tools like Prime Hunt support retrospective searches through existing telemetry for signs this chain was already used before patches were applied.