Ivanti Connect Secure Got Rooted Again, This Time By Three Bugs Holding Hands

If your VPN appliance has a pulse and a public IP, congratulations, you are once again the main character. CVE-2026-104935 landed on CISA KEV today, and the patch for the privilege escalation piece is still “coming soon,” which is corporate for “sleep tight.”

Volexity caught an unknown actor they track as UTA0576 chaining an authentication bypass, a remote code execution bug, and a privilege escalation into unauthenticated root on a fully patched (at the time) Ivanti Connect Secure box running 22.8R2.4. Ivanti published fixes for the auth bypass and RCE on October 13, 2026. CISA added the CVE to KEV the same day. The priv-esc is still waiting on a future release. Cool. Cool cool cool.

What happened

In the first week of October 2026, Volexity investigated suspicious activity at a Network Security Monitoring customer and traced it to an ICS VPN appliance that was current on patches. Forensic work (memory, disk, core dumps) reconstructed a three-stage chain:

• Auth bypass in welcome.cgi: the URL path decides whether the request is allowed, while the X-DSCGI-PATH header decides which CGI actually runs. Point the URL at the public login page, point the header at a protected script, and the front door lets you into the kitchen.
• RCE via wu.cgi: upload a Perl script with a .zip extension. The handler writes it under /home/runtime/tmp/<MD5(filename)>, then deletes it after the ZIP check fails. Race the deletion with parallel requests that execute that temp path through the same header trick, and your code runs as the cgi-server user.
• Privilege escalation through dsinvoked: patch the in-memory copy of libdsplibs.so, rewrite a DSCache maintenance task to launch Perl, ask the root broker to run it, then put everything back so the Integrity Checker Tool sees nothing on disk.

Ivanti tracks the auth bypass and RCE under CVE-2026-104935 (CVSS 8.6, CWE-290). Rapid7 notes a piece of this was found through Ivanti’s product security program and fixed in 25.1.3.0 in July 2026, while backports to other trains were still cooking. Exploitation happened in that gap. Classic.

Who is screwed

Per Ivanti and Rapid7, upgrade these lines:

• 25.1.1.1 and prior → 25.1.1.2
• 25.1.2.2 and prior → 25.1.3.0 or 25.1.3.1
• 22.8R2.4 and prior → 22.8R2.5

Versions 22.7.x and below are listed as unaffected. If you are on 22.8R2.4 Build 19097 and thought “fully patched” meant “safe,” welcome to the club. Membership is free. Therapy is not.

What UTA0576 did after root

No web shell. No persistent backdoor on disk. Every command re-ran the whole chain and returned results over HTTPS. Post-exploitation focused on credentials:

• LDAP and domain credentials stored on the appliance
• Custom tools hunting LAPS passwords, BitLocker recovery keys, and password-bearing AD attributes
• Kerberos helper with Kerberoast capability
• Packet capture of LDAP (TCP 389) via a renamed sniffer in a hidden .icscap directory
• Password spraying, DNS recon, config and auth-log theft
• Anti-forensics: scrub debuglog and audit.log, restore in-memory patches, delete temp scripts

Volexity assesses criminal motivation with low confidence. Operator host noted in the public report: 108.165.147.64 (Evoxt VPS, also running OpenVPN around Sept 30 to Oct 7). They also assess medium confidence that LLMs helped with exploit and post-ex scripting, based on how the chain was operated. Whether you believe the AI angle or not, the tradecraft is real.

What to do Monday morning

1. Patch to the fixed builds above. Emergency change window. Not “next maintenance Friday.”
2. Hunt for X-DSCGI-PATH mismatches on anything in front of ICS (see our proxy-log hunt how-to). Burst traffic to /dana-na/auth/url_default/welcome.cgi with weird headers is the tell.
3. Check /tmp/ for leftover post-ex scripts and JSON dumps if you still have the box.
4. Assume credential theft. Rotate appliance service accounts, review LAPS and BitLocker key access, watch for password spray follow-on.
5. If compromise is suspected, follow Ivanti recovery steps. A patch does not evict a tenant who already walked the halls.

Sloth take

Edge VPN appliances are where hope goes to die. We keep putting the keys to Active Directory on a FreeBSD box that faces the internet, then act shocked when someone finds a header parsing bug. UTA0576 did not need a zero-day for the priv-esc to matter. They needed one boring race condition and a broker that trusted a config store. Your board slide that says “VPN hardened” needs a footnote that says “except when three bugs hold hands.”

Need a grown-up to look at your edge stack? Book a slot with Dark Edge Consulting. We do the boring, careful work so you can go back to ignoring your inbox.

Sources

• Volexity, A Series of Unauthenticated Events (2026-10-13): volexity.com
• Rapid7, Ivanti Connect Secure zero-day exploited (2026-10-13): rapid7.com
• Ivanti Security Advisory CVE-2026-104935: hub.ivanti.com
• Ivanti October 2026 Security Update: ivanti.com
• CISA KEV catalog (added 2026-10-13): known_exploited_vulnerabilities.json