If your organization uses an Ivanti Connect Secure VPN appliance to let remote workers into your network, stop scrolling and check your version right now. On October 13 CISA added CVE-2026-104935 to its Known Exploited Vulnerabilities catalog after security researchers caught a threat actor chaining three zero-days to hijack fully patched appliances with no credentials at all. CISA gave federal agencies until October 16 to remediate.
This is a serious one. Volexity researchers discovered the actor they track as UTA0576 exploiting the chain since at least October 3 – against an appliance running 22.8R2.4, which was fully patched, the latest build available at the time. The exploit chain combines an authentication bypass, a remote code execution flaw, and a privilege escalation bug to achieve unauthenticated root-level code execution. That means a remote attacker who needs no credentials and no user interaction can take over the device completely.
What the vulnerability is. Ivanti tracks the authentication bypass and remote code execution components of the chain under CVE-2026-104935. The bypass lives in the welcome.cgi handler – it lets requests be routed to arbitrary CGI files, including ones normally protected by authentication. The researchers also documented a file-write flaw in wu.cgi: the upload handler writes a file to disk before verifying it is a valid ZIP, then deletes it. UTA0576 exploited that by uploading a Perl script disguised as a ZIP and racing parallel requests to execute it before the delete landed. The third leg, a privilege escalation flaw where the privileged dsinvoked broker trusts manipulated DSCache configuration data, allows the attacker to run their own code as root. Net result: three unauthenticated zero-days chained together give full root access.
What the attackers did with the access. This is not a hit-and-run. UTA0576 actively worked the compromised box and did not even deploy a backdoor or web shell – the attackers ran commands and passed results through the HTTPS requests themselves, and tampered with audit logs to dodge Ivanti’s Integrity Checker Tool. Post-exploitation focused on credential theft and lateral movement prep: dumping Active Directory queries to JSON files for exfiltration, parsing an existing packet capture for plaintext LDAP credentials, HTTP Basic auth, and NTLM challenge-response hashes, and harvesting LAPS passwords and BitLocker recovery keys. Volexity assesses the actor was preparing for a broader compromise of the victim network.
Affected versions. Ivanti says these branches and earlier are vulnerable: 25.1.1 (fixed in 25.1.1.2), 25.1.2 (fixed in 25.1.3.0 or later), and 22.8R2 (fixed in 22.8R2.5). Versions 22.7 and below are not affected.
The catch: one leg is still unpatched. Ivanti shipped fixes for CVE-2026-104935 on October 13, covering the authentication bypass and the RCE. But the privilege escalation bug used in the same chain is not yet patched – Ivanti says a fix will land in a future release in the coming weeks. Treat an unpatched ICS appliance as compromised until proven otherwise.
What you need to do right now.
Upgrade immediately. Move any affected Connect Secure appliance to a fixed build now. There is no reason to sit on 22.8R2.4, 25.1.1.1, or 25.1.2.2 when a remedy exists.
Do not trust the Integrity Checker Tool to signal compromise. Volexity was explicit: the actors tampered with logs and left no web shell, so the ICT may not flag the device. That cleaned-disk appearance is exactly what the anti-forensics was designed to produce.
Hunt for indicators before and after patching. Patching closes the door; it does not evict someone already inside. Check /tmp/ for post-exploitation artifacts, review /data/.icscap/ for packet captures and dropped scripts, and look for audit.log or debuglog entries missing from expected time windows. Any lateral movement originating from the ICS VPN device points to a compromised appliance – initiate full incident response and preserve memory and core dumps for forensics (Volexity’s memory analysis with its Volcano tool is how the chain was reconstructed).
Reduce exposure of the device. Make sure the Connect Secure admin interface and VPN endpoints are not unnecessarily exposed, and monitor for the URL-path versus X-DSCGI-PATH mismatches that tip off this class of exploit.
Do not wait on this one. A KEV-listed, actively exploited zero-day chain that hands an unauthenticated attacker root on your remote-access gateway – with one leg still unpatched – is as urgent as it gets. If you run Ivanti Connect Secure, patch today, then treat the box as compromised until you have inspected it. If you suspect a breach, bring in forensics before you wipe anything.