A newly disclosed vulnerability in Ivanti Connect Secure is already being used to seize complete control of corporate VPN appliances, Ivanti and the security firm Volexity have confirmed. The flaw, tracked as CVE-2026-104935, carries a CVSS score of 8.6 and lets an attacker with no credentials bypass authentication entirely and run arbitrary commands, turning the very device meant to secure remote access into an open door.
Ivanti confirmed limited exploitation on October 13, 2026, and the U.S. Cybersecurity and Infrastructure Security Agency added the bug to its Known Exploited Vulnerabilities catalog the same day, giving federal civilian agencies until October 16 to remediate. For any organization running an internet-facing Connect Secure appliance, that compressed timeline reflects the severity of what investigators found.
How the attack chain actually works
The flaw, classified under CWE-290 as an authentication bypass by spoofing, exploits a mismatch in how Ivanti Connect Secure decides whether a request needs credentials. A publicly reachable endpoint, welcome.cgi, performs the authentication check, but an accompanying HTTP header, X-DSCGI-PATH, can redirect the actual request to a different, normally protected script. The system authorizes based on one path while executing another - a routing inconsistency that effectively nullifies the access control.
Investigators from Volexity traced how the threat actor, designated UTA0576, used this trick to reach wu.cgi, an upload handler. By submitting a malicious Perl script disguised as a ZIP file, and firing parallel requests during the brief window before the server validated and deleted the file, the attacker executed code as the lower-privileged cgi-server account before the file was removed. From there, a separate and still-unpatched privilege-escalation zero-day, involving the dsinvoked service, allowed the intruder to run commands as root - full administrative control of the appliance.
Why this intrusion is unusually difficult to detect
What distinguishes this campaign is its restraint. Rather than planting a persistent web shell or backdoor file, the attackers repeated the entire exploitation sequence each time they needed to issue a new command, retrieving output directly through encrypted web traffic. Because much of the manipulation occurred in memory and temporary configuration changes were quietly reversed afterward, the intrusion left few traces on disk.
That matters because Ivanti's Integrity Checker Tool, the primary mechanism customers rely on to spot tampering, is built to catch unexpected file modifications. An attack engineered to avoid altering stored files can produce a clean scan even on a compromised system. Volexity's analysis makes clear that a passing integrity check is reassuring but not conclusive - a meaningful shift in how defenders should interpret that signal.
What attackers were after once inside
Once established with root access, the intruders moved methodically toward identity infrastructure rather than simple destruction. They harvested credentials stored on the appliance, queried Active Directory, hunted for Windows LAPS passwords and BitLocker recovery keys, attempted password spraying, and captured LDAP traffic - the groundwork for lateral movement deep into a victim's network. Custom Python and Kerberos tooling was used to test stolen credentials against directory services, with staging files briefly parked in temporary directories before exfiltration and cleanup.
Attribution remains unsettled. Volexity assesses with low confidence that the group's motives may be criminal rather than espionage-driven, and separately suggests, with medium confidence, that large language models may have assisted in building or refining parts of the exploit - a detail that speaks to how automated tooling is reshaping offensive tradecraft, even if it cannot yet be stated as fact.
What organizations should do now
Ivanti has shipped fixes for the authentication bypass and remote code execution components across supported branches, including versions 22.8R2.5, 25.1.1.2, 25.1.3.0, and 25.1.3.1. The vendor is urging customers to move toward the 25.x line altogether, since the 22.x branch is nearing end of life. Crucially, the privilege-escalation zero-day used alongside CVE-2026-104935 remained unpatched at the time of disclosure, which makes closing the initial entry point the single most effective defensive move available right now.
- Patch immediately to the fixed release matching your deployed branch rather than waiting on integrity scans alone
- Monitor for abnormal volumes of requests to welcome.cgi, particularly where X-DSCGI-PATH references wu.cgi or temporary files
- Inspect appliance logs and /tmp/ directories for unexplained scripts or reconnaissance artifacts
- Rotate credentials accessible through the appliance, including LDAP service accounts, following any containment
- Review Active Directory for suspicious LDAP queries, password spraying, and anomalous Kerberos activity
Security teams facing this threat can use platforms such as SOC Prime's AI-Native Detection Intelligence environment to convert the technical detail Volexity has published into operational hunting queries and detection rules across SIEM, EDR, and XDR systems. Given how much forensic evidence this attack erases from disk, memory and network-based investigation, not static file review, will determine whether a compromise is caught in time.
