If your organization runs Ivanti Connect Secure (ICS), this is the week to drop everything: on Tuesday, October 13, Ivanti disclosed CVE-2026-104935, a high-severity authentication bypass by spoofing with a CVSS score of 8.6 that lets a remote, unauthenticated attacker execute arbitrary commands on the VPN appliance, and it had already been exploited as a zero-day. Threat intel firm Defused told BleepingComputer it first saw in-the-wild abuse on October 1, Volexity traced a chained attack beginning October 3, and CISA added the flaw to its Known Exploited Vulnerabilities (KEV) catalog the same day as disclosure, ordering federal agencies to secure their systems by Friday, October 16. Making matters trickier, one link in the attack chain is still unpatched and Ivanti’s own Integrity Checker may not see the intrusion at all. Here’s what happened, how the exploit works, and what IT and network teams should do right now.
A VPN Zero-Day Exploited Before Anyone Knew
Ivanti warned customers to “act immediately” because of “limited exploitation in the wild,” according to BleepingComputer. Rapid7 notes that Ivanti originally found part of the vulnerability through its own product security program and fixed it in the July 2026 release of 25.1.3.0; exploitation happened while the company was still backporting that fix to the remaining supported versions.
The scale of potential exposure is significant. Internet watchdog Shadowserver tracks more than 5,600 internet-exposed hosts with ICS fingerprints, as reported by BleepingComputer, though it is unclear how many are patched or are honeypots. SC Media reports that Previdian observed 108 exploitation attempts against its honeypots from 50 unique IP addresses, geolocated to Singapore and the United States, and NHS England’s National CSOC assesses further exploitation as “highly likely.”
Inside the Exploit Chain
Volexity, which discovered the attacks while investigating a Network Security Monitoring customer starting October 5, found an unknown threat actor it tracks as UTA0576 compromising an appliance that was fully patched at the time (22.8R2.4, Build 19097). As Volexity put it, “This exploit chain combined an authentication bypass, a remote code execution (RCE), and a privilege escalation vulnerability to achieve unauthenticated root-level code execution.” The three links work like this:
- Authentication bypass: requests hit the public login script welcome.cgi, but an X-DSCGI-PATH header names a different, protected CGI script; the URL decides whether the request is allowed while the header decides where it actually goes
- Remote code execution: the attacker uploads a Perl script disguised as a .zip to wu.cgi, which writes the file to disk before validating it, then races parallel requests to execute it in the brief window before deletion
- Privilege escalation (still unpatched): by patching an Ivanti library in memory, the attacker tampers with the DSCache configuration store so the root-level dsinvoked service runs a malicious script as root
Ivanti tracks the authentication bypass and RCE together as CVE-2026-104935. The privilege escalation flaw has no patch yet and is not in the KEV catalog; Volexity says Ivanti is working on a fix that will ship “in the coming weeks.”
What the Attackers Did Once Inside
This was not a smash-and-grab. Volexity assessed with high confidence that UTA0576 was actively working the compromised appliance by hand, focusing on credentials and Active Directory. Highlights from its forensic report include:
- Credential theft: extracting domain credentials stored on the appliance, such as those used with LDAP
- Active Directory mining: a custom Python LDAP tool hunted for LAPS local admin passwords, BitLocker recovery keys, and password-bearing attributes
- Kerberos and spraying: a custom Kerberos tool with Kerberoast capability plus password-spraying runs against AD accounts
- Traffic sniffing: a renamed tcpdump hidden in a dot-directory captured plaintext protocol traffic, including LDAP on TCP 389
- Anti-forensics: selective scrubbing of Ivanti debug logs and Linux audit logs, with no web shell or backdoor left behind
Because commands ran in memory and the attacker restored modified state afterward, Ivanti’s Integrity Checker Tool reported nothing. Volexity assessed with low confidence that the actor is criminally rather than espionage-motivated, and with medium confidence that it uses large language models for exploit development and post-exploitation work.
Patch Now: Fixed Versions and CISA’s Deadline
Ivanti released fixed builds on October 13. According to the advisory as summarized by Rapid7, the upgrade paths are:
- 25.1.1.1 and prior: upgrade to 25.1.1.2
- 25.1.2.2 and prior: upgrade to 25.1.3.0 or 25.1.3.1
- 22.8R2.4 and prior: upgrade to 22.8R2.5
- 22.7.x and below: not affected, per the vendor advisory
Under Binding Operational Directive 26-04, Federal Civilian Executive Branch agencies have until October 16 to remediate. CISA urged everyone else to “immediately update to the latest version” and flagged that ICS 22.8 reaches end of life on January 31, 2027, so 22.8 shops should plan their move to 25.x. Rapid7 recommends applying the update on an emergency basis outside normal patch cycles.
A Clean Scan Is Not Proof of a Clean Appliance
Patching closes the door, but it does not tell you whether someone already walked through it. CISA states that organizations “will need to conduct network and memory forensics to identify evidence of exploitation.” As Justin Moore, director of adversary operations at Arctic Wolf, told SC Media, “A clean scan from the vendor’s own tool is not proof of a clean appliance.” Practical steps drawn from CISA and Volexity guidance:
- Hunt the logs: watch for large volumes of requests to /dana-na/auth/url_default/welcome.cgi and for mismatches between the URL path and the X-DSCGI-PATH header
- Check /tmp/: look for leftover post-exploitation scripts and output files
- Rebuild if compromised: back up the configuration, factory reset and upgrade (rebuild virtual instances), then restore the config
- Rotate everything: reset domain, administrator, and local account passwords, revoke and reissue stored certificates, and reset stored API keys and license server credentials
- Review AD exposure: given the targeting of LAPS and BitLocker data, consider rotating those secrets and auditing the appliance’s AD service account
Looking Ahead
Ivanti Connect Secure has been a repeat target: BleepingComputer recounts zero-days including CVE-2023-46805 and CVE-2024-21887 in January 2024, CVE-2024-21893 shortly after, CVE-2025-0282 in January 2025, and CVE-2025-22457 later that year. CISA has now added 36 Ivanti vulnerabilities to KEV since November 2021, 12 of them used in ransomware attacks. With the privilege escalation fix still pending, admins should treat this as an open incident rather than a one-and-done patch and watch closely for Ivanti’s follow-up release.
The bigger lesson is about edge devices in general. As Robert Costello, chief digital and information officer at the Merlin Group, told SC Media, “Attackers are now increasingly using AI to accelerate vulnerability discovery, automate exploit development, and scale reconnaissance across exposed systems.” VPN gateways sit at the perimeter with deep access to identity systems, so expect more chained, memory-only attacks like this one, and plan for zero trust beyond the edge, tighter monitoring of appliance behavior, and faster emergency patching as the new normal.
Sources:
- CISA, October 13, 2026
- Volexity, October 13, 2026
- Rapid7, October 13, 2026
- NHS England Digital, October 13, 2026
- BleepingComputer, October 14, 2026
- SC Media, October 14, 2026
