A high-severity vulnerability in Ivanti Connect Secure is being exploited against fully patched appliances, giving unauthenticated attackers a path to complete control of corporate VPN gateways. Tracked as CVE-2026-104935 and scored 8.6 on the CVSS scale, the flaw was weaponized by a previously unknown threat actor identified as UTA0576, who chained it with a second, still-unpatched privilege-escalation bug to reach root on affected systems. Ivanti confirmed limited exploitation on October 13, 2026, and the vulnerability was swiftly added to the US Cybersecurity and Infrastructure Security Agency's Known Exploited Vulnerabilities catalog.
How the attack chain actually works
The intrusion, reconstructed by the security firm Volexity, begins with a quirk in how Connect Secure routes web requests. The publicly reachable endpoint /dana-na/auth/url_default/welcome.cgi does not require credentials, but attackers discovered that an HTTP header called X-DSCGI-PATH can redirect the underlying request to a different, normally protected CGI script. The appliance evaluates security based on the public-facing URL while actually executing whatever the header specifies - a mismatch that effectively erases the authentication boundary.
Using this technique, UTA0576 reached wu.cgi, an upload handler that briefly writes submitted files to a temporary directory before verifying that they are legitimate ZIP archives. By disguising a malicious Perl script with a .zip extension and firing a second, parallel request through the same header trick during the narrow window before the invalid file was deleted, the attacker triggered execution of the payload. This initial foothold ran under the lower-privileged cgi-server account, launching a Bash shell and then a Python stage that lived mostly in memory rather than on disk.
From low-privilege access to root control
Gaining code execution as cgi-server was only the first half of the operation. To escalate, the attackers exploited a separate, still-unfixed zero-day involving the privileged dsinvoked service and its configuration store, manipulating an in-memory library and a maintenance task so that dsinvoked executed attacker-supplied Perl code as root. Once privileged access was secured, the exploit quietly restored the altered memory state and configuration, then scrubbed relevant entries from Ivanti's debug logs and the underlying Linux audit logs.
That cleanup matters enormously for detection. Ivanti's Integrity Checker Tool is designed to flag unexpected changes to files on disk, but because large portions of this exploit chain operate only in memory and self-revert afterward, the tool can fail to notice anything wrong. The attackers also skipped installing a persistent web shell or backdoor file, instead re-running the entire exploitation sequence from scratch every time they needed to issue a new command, retrieving output directly over the same HTTPS connection.
What the attackers were after
Post-exploitation activity centered on identity infrastructure. Volexity observed the group harvesting credentials stored on the appliance, querying Active Directory, hunting for Windows LAPS passwords and BitLocker recovery keys, running password-spraying attempts, and capturing LDAP traffic using custom Python and Kerberos tooling. This is the classic playbook for lateral movement - a compromised VPN gateway sits at a privileged vantage point inside the network, making it a valuable launchpad rather than just an entry point. Volexity assesses with low confidence that the group's motivation is criminal rather than espionage-driven, and with medium confidence that it used large language models to help build or refine parts of the exploit.
What organizations should do now
Ivanti has shipped fixes for the authentication bypass and remote-code-execution components covered by CVE-2026-104935, with corrected builds available across the 22.8R2.5, 25.1.1.2, 25.1.3.0, and 25.1.3.1 lines. The company is urging customers to move toward the 25.x branch given that the 22.x line is nearing end of life. Critically, the privilege-escalation flaw used alongside this bug remains unpatched, which makes closing the initial entry point the only reliable way to stop the full chain, since reaching root first requires the authentication bypass.
- Patch affected Connect Secure instances immediately rather than relying on integrity scans alone.
- Continue running the Integrity Checker Tool, but treat a clean result with caution given its blind spot for memory-only tampering.
- Monitor for abnormal volumes of requests to the welcome.cgi endpoint, particularly where the X-DSCGI-PATH header references wu.cgi or temporary files under /home/runtime/tmp/.
- Inspect /tmp/ for unexplained scripts and review outbound traffic from the appliance toward Active Directory, LDAP, and DNS services.
- Rotate any credentials potentially exposed through the appliance, including LDAP service accounts, following containment.
Known indicators tied to the investigated incident include the IP address 108.165.147[.]64 and suspicious activity around /data/.icscap/, though defenders should treat these as supplementary to behavioral detection, since infrastructure and filenames can be changed easily. CISA's October 16 remediation deadline for federal civilian agencies signals how seriously the government is treating this exposure - a signal private-sector operators of internet-facing VPN infrastructure would do well to heed without delay.