Ivanti Connect Secure zero-days chained to gain root on VPN appliances

Ivanti released fixes on 13 October 2026 for CVE-2026-104935, an authentication bypass in its Connect Secure VPN appliance that was exploited before disclosure. Ivanti said it is aware of limited exploitation in the wild, and CISA added the flaw to its Known Exploited Vulnerabilities catalog the same day.

What is the vulnerability? #

CVE-2026-104935 is rated 8.6 out of 10. According to Volexity, which investigated the attack, it covers two flaws: an authentication bypass and a file write flaw that leads to remote code execution. Together they let an unauthenticated remote attacker run commands on the appliance.

Volexity says the attacker chained them with a third zero-day, a privilege escalation flaw, to run commands as root. Ivanti has not yet fixed that third flaw and plans to in a future release "in the coming weeks", Volexity said.

Which versions are affected? #

Versions 22.7.x and earlier are not affected, according to Rapid7's summary of Ivanti's advisory. Ivanti said part of the flaw was already fixed in 25.1.3.0, released in July 2026, and the exploitation happened while the fix was being backported to other versions, Rapid7 reported.

What did the attacker do? #

Volexity found the attack on one customer's appliance running 22.8R2.4, which was fully patched at the time. The attacker, which Volexity tracks as UTA0576, began exploiting it on 3 October. Volexity says the attacker:

• Extracted stored credentials, including LDAP domain credentials.
• Searched Active Directory for local administrator passwords, BitLocker recovery keys and other password data.
• Ran password-spraying attacks and captured LDAP traffic to harvest more credentials.
• Deleted log entries and its own files, and left no web shell or backdoor.

Ivanti's Integrity Checker Tool did not detect the changes, because the exploit altered code only in memory and restored the configuration data it changed, according to Volexity.

Volexity assesses with medium confidence that the attacker used large language models in developing the exploit and in later activity. It has low confidence that the motive is criminal rather than espionage.

What has CISA said? #

CISA urged organizations to update Connect Secure immediately and gave US federal civilian agencies until 16 October 2026 to apply the fixes, The Hacker News reported. CISA says confirming whether a system was compromised requires network and memory forensics.

If a compromise is found, CISA advises backing up the configuration, performing a factory reset, upgrading, restoring the configuration, resetting all account passwords, revoking and reissuing certificates, and resetting API keys and license server credentials. CISA also noted that version 22.8 reaches end of life on 31 January 2027.

Exploitation attempts are spreading. Honeypot operator Previdian recorded 105 attempts from 50 unique IP addresses as of 14 October. Its chief executive, Ryan Dewhurst, said the payloads so far mainly test for code execution, and warned that "full weaponized exploitation is likely to follow in the coming hours and days".

How can teams check for compromise? #

Ivanti says no reliable indicators of compromise are available. Volexity has published indicators from its investigation, including:

• Large numbers of requests to /dana-na/auth/url_default/welcome.cgi carrying an X-DSCGI-PATH header that does not match the URL path.
• A hidden directory at /data/.icscap/.
• Connections from the IP address 108.165.147[.]64.

Volexity says confirming a compromise requires network and memory forensics, since the Integrity Checker may miss it.

What should Connect Secure customers do? #

1. Upgrade to a fixed version immediately, outside normal patch cycles, as Rapid7 recommends.
2. Hunt for the indicators above even after patching, because the third flaw is not yet fixed.
3. If you find signs of compromise, follow Ivanti's recovery steps and CISA's guidance above, including resetting passwords and reissuing certificates.