Ivanti Connect Secure: three-zero-day chain gave root on a fully patched VPN, and the privilege escalation flaw remains unfixed

What happened

This report follows up on Orbitaley's 13 October story about the exploitation of CVE-2026-104935 in Ivanti Connect Secure (ICS). Since then, technical analysis from Volexity, the firm that uncovered the attacks, has changed the picture: the patched bug is only one part of a three-zero-day chain, and the last link, a privilege escalation to root, remains unpatched.

According to Volexity, an unknown actor it tracks as UTA0576 chained an authentication bypass in welcome.cgi via the X-DSCGI-PATH header, a file write in wu.cgi exploited through a race condition, and abuse of the dsinvoked service's trust in the DSCache configuration store. The result was root code execution on an appliance running every available patch (22.8R2.4, Build 19097). Ivanti groups the first two flaws under CVE-2026-104935; the third will be fixed “in the coming weeks”, according to Volexity and CERT.be.

The attacker installed no backdoor or web shell, instead re-running the full chain for each command and reading results from HTTPS responses. It stole domain LDAP credentials stored on the device, pulled Active Directory metadata, hunted for LAPS passwords and BitLocker recovery keys with custom tooling, captured LDAP traffic with a tcpdump binary renamed “dsstatmond” and ran password spraying. It then deleted log entries and restored the components it had tampered with.

What is confirmed and what is not

The status of each claim, with its source:

• Confirmed (CISA): active exploitation to steal credentials and exfiltrate data; added to the KEV catalogue on 13 October; US federal civilian agencies must patch by 16 October.
• Confirmed (CISA): Ivanti's Integrity Checker Tool may miss exploitation because commands run in memory.
• Confirmed (Ivanti, quoted by BleepingComputer and Security.NL): “limited” exploitation, no customer count, and no reliable indicators of compromise at disclosure.
• Confirmed (CCB/CERT.be): CVSS 8.6, CWE-290.
• Confirmed (Previdian, per The Hacker News): 105 attempts from 50 IPs in Singapore and the US against its honeypots; payloads test for code execution and deploy no malware yet.
• Unconfirmed (Defused, per BleepingComputer): first signs on 1 October, two days before Volexity's observations.
• Unconfirmed (Volexity, low confidence): criminal rather than espionage motive.
• Unconfirmed (Volexity, medium confidence, indirect evidence): use of large language models to build the exploit and operate on the device.
• Assessment (Volexity, high confidence): the actor was preparing lateral movement; its end goal is unknown because the operation was cut short.
• Unconfirmed (ITdaily only): 25.1.1.2 released on 5 October and 22.8R2.5 on 12 October, versus the 13 October date cited by Volexity.

Why it matters

ICS is the remote access gateway for many organisations: compromising it opens a path into the internal network and, as the documented case shows, into Active Directory secrets. Shadowserver counts more than 5,600 internet-exposed devices that look like ICS, BleepingComputer reports, though that figure does not exclude patched systems or honeypots.

The pattern is familiar. Rapid7 notes ICS was hit by zero-days in 2024 and 2025; in 2025, a flaw patched in February was exploited from March by a China-linked espionage actor, according to BleepingComputer. This time, CyberScoop and Rapid7 report that Ivanti found part of the bug in June, fixed it in version 25.1.3.0 in July and was still porting the fix to other branches when attacks began. CISA now counts 36 exploited Ivanti vulnerabilities, Security.NL reports.

Timeline

Key dates from the cited sources:

1. June 2026Ivanti internally finds part of the flaw (CyberScoop).
2. July 2026it is fixed in 25.1.3.0 (Rapid7).
3. 30 September to 7 OctoberUTA0576's server runs an active OpenVPN service (Volexity).
4. 1 Octoberfirst signs of exploitation, per Defused.
5. 3 OctoberUTA0576 begins attacking Volexity's customer.
6. 5 OctoberVolexity opens its investigation.
7. 10 OctoberVolexity shares indicators with its customers.
8. 13 OctoberIvanti advisory and patches, Volexity analysis, CISA alert and KEV listing.
9. 14 OctoberCERT.be advisory, Previdian honeypot attempts and Shadowserver count.
10. 16 OctoberCISA deadline for federal agencies.

What organisations can do

Ivanti offers no workaround, according to watchTowr: updating is the only option. Affected versions are 25.1.1.1, 25.1.2.2 and 22.8R2.4 and earlier; fixed releases are 25.1.1.2 (ISA6000/ISA8000), 25.1.3.0 and 25.1.3.1 (ISA4500/ISA6500/ISA8500) and 22.8R2.5. The 22.7.x branch is not affected.

• Before touching the appliance, preserve logs, configuration and device images (watchTowr).
• Look for bursts of requests to /dana-na/auth/url_default/welcome.cgi with X-DSCGI-PATH pointing to wu.cgi or /home/runtime/tmp/<MD5>, and any mismatch between URL and header, as variants are likely (Volexity).
• Check /tmp/, the hidden /data/.icscap directory and processes named dsstatmond; match traffic against 108.165.147[.]64 and the indicators Volexity publishes on GitHub.
• Do not rely on the Integrity Checker Tool alone: run memory and network forensics (CISA, Volexity) and keep hunting after patching (Rapid7).
• If compromise is suspected, follow CISA's steps: back up the configuration, factory reset and update (or rebuild virtual instances), restore the configuration, reset all domain, admin and local passwords, reissue certificates and rotate API keys and licence server credentials.

What to watch next

The key missing piece is the privilege escalation fix: there is no date, nor word on whether it will get its own CVE. It is also unknown how many organisations were hit, in which sectors or countries, whether the July fix covered the whole chain, and whether the attempts seen by Previdian and Defused come from UTA0576 or other actors.

Previdian's chief executive expects fully weaponised exploitation within hours or days, a forecast rather than a fact; NHS England Digital's national SOC reportedly sees further exploitation as “highly likely”, according to a secondary source. No public exploit code has been reported. Further out, the 22.8 branch reaches end of support on 31 January 2027, CISA says.

Sources

• Volexity: chained exploitation of Ivanti Connect Secure zero-days
• CISA alert on Ivanti Connect Secure
• CCB/CERT.be advisory
• Rapid7: Ivanti Connect Secure zero-day exploited in the wild
• watchTowr: CVE-2026-104935 FAQ
• BleepingComputer: CISA warns admins to fix Ivanti flaw
• BleepingComputer: Ivanti warns of Connect Secure zero-day
• The Hacker News: honeypots log 105 exploit attempts
• CyberScoop: Ivanti missed chance to fix flaw before attacks

Vulnerabilities (1)