Full Report
An attacker chained three zero-day flaws in Ivanti Connect Secure, a VPN appliance, to run commands as root without logging in, security firm Volexity said on October 13. Ivanti has released fixes for two of the flaws and told customers on affected versions to "act immediately." A fix for the third is still pending, according to Volexity. Volexity, which reported the flaws to Ivanti,
Analysis Summary
# Vulnerability: Ivanti Connect Secure Zero-Day Exploitation Chain
## CVE Details
- **CVE ID:** CVE-2026-104935 (Covers the authentication bypass and RCE; third CVE for privilege escalation is currently pending/unlisted).
- **CVSS Score:** 8.6 (High)
- **CWE:** Authentication Bypass, Remote Code Execution (RCE), and Privilege Escalation.
## Affected Systems
- **Products:** Ivanti Connect Secure (VPN Appliance).
- **Versions:** Affected versions include those "before version 25.1.3.0." Specifically noted vulnerable during active exploitation: version 22.8R2.4.
- **Configurations:** Systems running affected firmware versions exposed to the network. Note: Versions 22.7R2.14 or prior are listed as not affected by this specific chain.
## Vulnerability Description
This attack involves a chain of three zero-day vulnerabilities. The first two flaws (CVE-2026-104935) allow an unauthenticated remote attacker to bypass authentication and execute code with the privileges of the `cgi-server` user. The third flaw is a privilege escalation vulnerability that allows the attacker to elevate their permissions from the `cgi-server` user to **root**.
The exploit is sophisticated; it resides in memory by modifying library code and restores configuration data immediately after execution to evade standard detection mechanisms.
## Exploitation
- **Status:** Exploited in the wild (Targeted attacks by threat actor UTA0576 observed starting Oct 3, 2026).
- **Complexity:** Medium (Requires chaining three specific flaws).
- **Attack Vector:** Network (Unauthenticated).
## Impact
- **Confidentiality:** Total (Attacker can steal LDAP credentials and search Active Directory).
- **Integrity:** Total (Root access allows full system modification).
- **Availability:** Total (Full control over the VPN gateway).
## Remediation
### Patches
- **Ivanti Connect Secure:** Upgrade to version **25.1.3.0** or **25.1.3.1**.
- Version **22.8R2.5** is also listed as unaffected/patched.
### Workarounds
- No specific temporary workarounds (such as XML mitigation files) were provided in the report. Ivanti urges immediate upgrades to the latest supported patched versions.
## Detection
- **Indicators of Compromise (IoCs):**
- **URL Path:** High frequency of requests to `hxxps[:]//<appliance>/dana-na/auth/url_default/welcome.cgi`.
- **HTTP Header:** Presence of the `X-DSCGI-PATH` header where the value does not match the requested URL path.
- **File System:** Presence of the directory `/data/.icscap/`.
- **Network:** Traffic associated with IP `108.165.147[.]64`.
- **Detection Methods:**
- **Forensics:** Standard Integrity Checker Tools (ICT) may fail as the exploit operates in-memory. Forensic analysis of memory and network logs is required.
- **Monitoring:** Monitor for unusual Active Directory queries or password-spraying attempts originating from the VPN appliance.
## References
- Ivanti Security Advisory: [hxxps[:]//hub.ivanti.com/s/article/Security-Advisory-Ivanti-Connect-Secure-CVE-2026-104935]
- Volexity Technical Blog: [hxxps[:]//www.volexity.com/blog/2026/10/13/a-series-of-unauthenticated-events-chained-exploitation-of-ivanti-connect-secure-zero-days/]
- Ivanti Release Notes: [hxxps[:]//help.ivanti.com/ps/help/en_US/ICS/25.1.x/25.1.3.0/25.xICSRN.pdf]