Ivanti patched an authentication bypass flaw in its Connect Secure VPN appliances on October 13, 2026, five days after a previously unknown threat actor had already started exploiting it to gain full, unauthenticated root access. The flaw, tracked as CVE-2026-104935, affects Connect Secure 22.8R2.4 and earlier, 25.1.1.1 and earlier, and 25.2.2 and earlier. CISA added it to its Known Exploited Vulnerabilities catalog the same day and gave federal agencies until October 16 to patch, a deadline that has already passed.
How the attack actually works
According to Volexity’s writeup, the attacker doesn’t go in through CVE-2026-104935 alone. A request to the public welcome.cgi endpoint carries a spoofed X-DSCGI-PATH header that routes it to a protected script called wu.cgi. That script has a race condition in its file upload handler, and a well-timed request lets an uploaded script run before the system deletes it, handing the attacker code execution as the appliance’s low-privileged cgi-server user.
From there the attacker escalates to root by patching an in-memory library and tampering with a privileged maintenance task so the dsinvoked broker process runs attacker-supplied commands. Volexity found this on a device that was already fully patched for CVE-2026-104935 alone, which is the part worth sitting with: patching the one CVE with an assigned number does not close the chain. No web shell or persistent malware gets dropped anywhere in this process, since every command and response travels over the exploit’s own HTTPS requests.
Who’s behind it, and what they went after
Volexity tracks the group as UTA0576 and says it has been active since at least October 3, with post-exploitation work focused on credential theft: dumping Active Directory data, harvesting LAPS passwords and BitLocker recovery keys, Kerberoasting, password spraying, and reviewing captured LDAP traffic for anything useful. The firm assesses with low confidence that the motive is criminal rather than espionage, though that assessment could change as more victims come forward.
The patch covers one hole, not all three
Ivanti’s October 13 update fixes CVE-2026-104935, the entry point. The privilege escalation step that gets the attacker from cgi-server to root still has no vendor fix. Ivanti has said one is coming in a future release, which leaves every patched appliance still exposed to the back half of the chain in the meantime. Worse, Ivanti’s own Integrity Checker Tool won’t flag a device compromised this way, since the attacker’s cleanup restores the modified state and clears logs behind itself. Confirming a device is clean means actual network and memory forensics, not a built-in scan.
What to do if you run Connect Secure
- Apply Ivanti’s October 13 patch immediately if you haven’t. The federal deadline already passed; treat it as overdue, not optional.
- Search access logs for requests to
welcome.cgiwhere theX-DSCGI-PATHheader doesn’t match the request path, which is the tell Volexity used to spot the activity. - Check
/tmp/for leftover artifacts from the upload race condition, and don’t rely on the Integrity Checker Tool as proof the box is clean. - Rotate AD credentials, LAPS passwords, and BitLocker keys for anything reachable from an appliance that may have been compromised before the patch went out.
This is the same shape of story ConicPlex has flagged before with Citrix’s NetScaler zero-day and Zimbra’s actively exploited RCE flaw: edge appliances that sit between the public internet and an internal network keep being the entry point attackers reach for first, and a single CVE number rarely tells the whole story of what needs fixing.
