Ivanti warned customers on 13 October 2026 that attackers are exploiting a three-vulnerability chain against Connect Secure VPN appliances. The chain can produce unauthenticated root-level code execution, while its final privilege-escalation component remains unpatched.
Ivanti said the exploitation affected a “limited number of customers” at disclosure, without providing a count. Volexity discovered the activity while investigating an intrusion at one customer and tracks the previously undocumented threat actor as UTA0576.
CISA added CVE-2026-104935 to its Known Exploited Vulnerabilities catalog on 13 October 2026, confirming that the flaw is being used in attacks rather than remaining a theoretical risk.
Three flaws turn remote access into root execution
The attack combines an authentication bypass, remote code execution and a privilege-escalation flaw. According to reporting on Volexity’s investigation, the authentication bypass and code-execution issues are tracked together as CVE-2026-104935. They allow a remote attacker without credentials or user interaction to execute commands as the cgi-server user.
The third zero-day then elevates those privileges to root. Ivanti has patched the first two components, but said the privilege-escalation fix would arrive in “a future release in the coming weeks.”
CVE-2026-104935 has a CVSS v3.1 score of 8.6, rated high, with the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L. It is classified as CWE-290, Authentication Bypass by Spoofing. The network-accessible, low-complexity path requires neither prior privileges nor user action.
That severity score measures technical characteristics; the KEV listing and Ivanti’s disclosure provide separate evidence that exploitation is active.
Affected releases and a disputed version boundary
The NVD description says Connect Secure before version 25.1.3.0 is vulnerable, while explicitly excluding ICS 22.7R2.14 and prior. The CVE record, as reported, also lists these releases as unaffected:
- 22.8R2.5
- 25.1.3.0
- 25.1.3.1
SecurityWeek reports that Ivanti identified the following as fixed releases:
- 22.8R2.5
- 25.1.1.2
- 25.1.3.0
- 25.1.3.1
The status of 25.1.1.2 is unclear from the available version data: it appears in the reported Ivanti fixed-release list, but falls below the NVD threshold of 25.1.3.0 and is absent from the CVE record’s reported unaffected list. Administrators should not infer its status from either range alone.
Volexity’s compromised appliance was running 22.8R2.4 and was described as fully patched at the time. Reporting does not explain how that description relates to the subsequently listed 22.8R2.5 fix.
Attackers targeted credentials and directory data
Volexity found evidence of exploitation beginning on 3 October. In the incident it investigated, the attackers stole credentials stored on the appliance, including LDAP domain credentials, and removed a limited amount of Active Directory metadata.
Post-exploitation actions included:
- Searching Active Directory for LAPS passwords and BitLocker recovery keys with a custom tool.
- Password spraying against accounts.
- Testing credentials through a custom Kerberos utility.
- Attempting to recover credentials from captured network traffic.
- Scanning the internal network.
- Collecting appliance configuration data.
- Parsing authentication logs for valid usernames.
- Tampering with logs.
The attackers reportedly reran the complete exploit chain for each command. Volexity found no persistent backdoor or web shell on the appliance, but assessed with high confidence that the activity was preparing for lateral movement and broader network compromise. The operation was disrupted before its ultimate objective became clear.
Volexity assessed with low confidence that UTA0576 is financially motivated rather than engaged in espionage. It separately assessed with medium confidence that the actor uses large language models during exploit development and post-exploitation.
Integrity checks may not expose the intrusion
The exploit modifies library code in memory and restores configuration data after making changes. This behavior can prevent Ivanti’s Integrity Checker Tool from detecting the chain, despite Ivanti recommending that customers run the tool regularly.
Indicators reported from Volexity’s investigated incident include:
- Repeated requests to
/dana-na/auth/url_default/welcome.cgi - An
X-DSCGI-PATHheader whose value does not match the requested URL path - The directory
/data/.icscap/ - The IP address
108[.]165[.]147[.]64
These indicators describe one investigated intrusion and should not be treated as an exhaustive detection rule. Volexity said confirming compromise requires forensic investigation, including network and memory analysis.
Upgrade promptly and investigate for prior access
Ivanti advises customers on affected releases to upgrade to a fixed version and run its Integrity Checker Tool regularly. Because the observed chain can evade that tool, appliances exposed during the exploitation window also warrant forensic triage rather than relying only on a clean integrity-check result.
The upgrade addresses the authentication-bypass and remote-code-execution components. The separate privilege-escalation flaw remains awaiting a vendor fix, although the available reporting does not establish its residual exploitability after the first two flaws have been patched.
CISA requires covered US federal agencies to remediate CVE-2026-104935 by 16 October 2026. Its required action is to apply vendor mitigations while complying with BOD 26-04 Prioritizing Security Updates Based on Risk and CISA’s Forensics Triage Requirements. For applicable cloud services, agencies must follow BOD 26-04; if mitigations are unavailable, CISA directs them to discontinue use of the product.
That deadline applies to covered federal agencies, not every Connect Secure operator. For other organizations, the active exploitation, remote unauthenticated entry point and potential access to domain credentials make rapid upgrading and compromise assessment the practical priorities.
