Ivanti has released emergency security updates after attackers exploited a chain of three zero-day vulnerabilities in its Connect Secure VPN appliances to gain root-level access without authentication.
Two of the vulnerabilities are tracked together as CVE-2026-104935, which carries a CVSS score of 8.6. Ivanti released patches on October 13, but the third vulnerability, which allows an attacker to escalate privileges to root, remains unpatched.
How Attackers Exploited Three Ivanti Zero-Days
The attacker began exploiting the vulnerabilities on October 3, targeting an appliance running Ivanti Connect Secure 22.8R2.4.
At the time of the intrusion, that version was fully patched.
The attack combined three distinct security weaknesses, each enabling the next stage of compromise.
1. Authentication Bypass
The first vulnerability affects how Ivanti Connect Secure handles requests to Common Gateway Interface (CGI) scripts.
The attacker sent requests to a publicly accessible login-related endpoint while manipulating an internal routing header called X-DSCGI-PATH.
The appliance checked the public URL to determine whether authentication was required but used the manipulated header to determine which internal script should execute.
This inconsistency allowed the attacker to access normally restricted CGI functionality without authenticating.
2. Remote Code Execution
After bypassing authentication, the attacker exploited a file-handling weakness in the wu.cgi upload component.
Volexity discovered that the attacker submitted a malicious Perl script disguised as a ZIP file. Although the appliance ultimately rejected and deleted the invalid file, it was temporarily written to disk before validation completed.
The attacker exploited this brief window to execute the uploaded script before the appliance removed it.
This race condition provided arbitrary code execution under the appliance’s less-privileged cgi-server account.
Ivanti has assigned the authentication bypass and remote code execution components to CVE-2026-104935.
3. Privilege Escalation to Root
The final vulnerability allowed the attacker to elevate access from the cgi-server account to root.
The exploit targeted how Ivanti’s privileged dsinvoked service retrieves instructions from a shared configuration store called DSCache.
By temporarily modifying an Ivanti library in memory, the attacker manipulated the configuration used by the privileged service, causing it to execute attacker-controlled commands with root privileges.
After execution, the malicious code restored the modified memory and configuration data to their original state.
This final stage effectively gave the attacker complete control over the appliance.
Although the authentication bypass and RCE vulnerabilities have been patched, Ivanti has not yet released a fix for the privilege escalation issue. The company is expected to address it in a subsequent security update.
The available patches interrupt the demonstrated unauthenticated attack chain. However, the unresolved privilege escalation flaw remains a concern if an attacker obtains another foothold on the appliance.
Affected Versions and Available Security Updates
Ivanti has released fixes for CVE-2026-104935 affecting multiple Connect Secure software branches.
The following versions are affected, according to the vendor’s guidance:
| Affected versions | Fixed versions |
| 22.8R2.4 and earlier within the affected 22.8 branch | 22.8R2.5 |
| 25.1.1.1 and earlier within the applicable branch | 25.1.1.2 |
| 25.1.2.2 and earlier within the applicable branch | 25.1.3.0 or 25.1.3.1 |
Versions 22.7R2.14 and earlier are not affected by CVE-2026-104935.
Ivanti also confirmed that the vulnerability had already been addressed in the 25.1.3.0 release issued in July 2026. The October updates extend protection to other supported versions.
Administrators should consult the official Ivanti security advisory to determine the appropriate upgrade path.
CISA added the vulnerability to its KEV catalog on October 13 and established an October 16, 2026, remediation deadline for affected U.S. federal civilian executive branch agencies.
Organizations outside the federal government should also prioritize remediation because exploitation has already been confirmed.
Indicators of Compromise and Detection Opportunities
| Indicator | Description |
| 108.165.147[.]64 | Attacker-controlled infrastructure observed in the investigated intrusion |
| /dana-na/auth/url_default/welcome.cgi | Public endpoint repeatedly targeted during exploitation |
| X-DSCGI-PATH | HTTP header manipulated to access restricted CGI functionality |
| /data/.icscap/ | Directory associated with packet-capture and credential-harvesting activity |
| /tmp/ml.py and /tmp/rq5.py | Files associated with the attacker’s LDAP tooling |
| /tmp/mk.py and /tmp/rr.py | Files associated with Kerberos-related tooling |
Additional Suspicious Behaviors
Defenders should investigate unusually high volumes of requests to the affectedlogin endpoint, particularly when the X-DSCGI-PATH header references a different internal CGI path.
Unexpected files in temporary directories, unexplained packet-capture activity, and processes executing under unusual contexts may also indicate compromise.
The attacker specifically targeted the following log files for manipulation:
- /home/runtime/dlogs/debuglog
- /var/log/audit/audit.log
Missing or inconsistent log entries around suspicious activity should therefore be examined carefully.
Because the attacker deliberately removed artifacts and restored modified files, the absence of these indicators does not establish that an appliance is secure.
Where possible, security teams should correlate appliance evidence with externally collected network logs, authentication events, and Active Directory activity.
Recommended Mitigation and Response Measures
Organizations operating Ivanti Connect Secure should take the following actions.
1. Upgrade affected appliances immediately
Deploy the appropriate fixed release for the affected software branch.
Although the separate privilege escalation vulnerability remains unresolved, applying the current patches prevents the initial authentication bypass and RCE sequence used in the observed attack.
Organizations should also monitor Ivanti’s security advisories for the remaining privilege escalation fix.
2. Investigate devices that were vulnerable before patching
Because exploitation began before public disclosure, patching alone does not establish whether an appliance was previously compromised.
Review historical network activity and investigate suspicious behavior originating from Ivanti VPN infrastructure.
Pay particular attention to appliances that were internet-accessible during early October 2026.
3. Do not rely exclusively on the Integrity Checker Tool
Continue using Ivanti’s Integrity Checker as part of standard security monitoring, but recognize its limitations against this exploit chain.
Where compromise is suspected, conduct memory and network forensics and follow Ivanti’s published recovery procedures.
A negative integrity check should not override other evidence of suspicious activity.
4. Assess exposed credentials and connected systems
Review credentials accessible to the VPN appliance, including LDAP service accounts and other authentication integrations.
If compromise is confirmed or credentials may have been exposed, rotate affected secrets and investigate their use across the environment.
Organizations should also review Active Directory activity for unexpected password spraying, privileged account access, and suspicious queries involving LAPS passwords or BitLocker recovery information.
5. Limit the potential impact of a VPN appliance compromise
Restrict unnecessary access from VPN appliances to internal infrastructure and ensure service accounts have only the permissions required for their intended functions.
Centralize security logs outside the appliance wherever possible, reducing the attacker’s ability to destroy all evidence of malicious activity.
If patching cannot be completed immediately, organizations should assess options to restrict exposure or temporarily remove vulnerable services from the internet.
These measures reduce risk but are not substitutes for the available security updates.
Stay Safe. Stay Secure.
OP Innovate Research Team
