Attackers got root on fully patched Ivanti VPNs. Upgrade Connect Secure today and check Active Directory

If your company’s VPN runs on Ivanti Connect Secure, it needs an upgrade today and a closer look afterwards. Ivanti released fixes on October 13 for a bug attackers used to run commands on the appliance without logging in, starting on October 3.

Volexity, which found the attack at a customer, says the box was fully patched at the time. The attackers used it to go after Active Directory: domain credentials, local administrator passwords from LAPS and BitLocker recovery keys.

The VPN box was fully patched and still got owned. Patch it today, then check whether someone already went through it.

The 5-Minute Cyber Brief

Don’t Miss the Policy Changes That Affect Security Decisions

Get the key CISA actions, new regulations, guidance, and risk shifts in a quick daily brief.

Email addressSend me tomorrow’s brief

By subscribing you agree to our Privacy Policy.

Free. Weekday mornings. 5 minutes or less.

Attackers chained Ivanti VPN zero-days to get root

Ivanti tracks the bug as CVE-2026-104935, an authentication bypass by spoofing that lets a remote attacker with no account run commands. Rapid7 reports a CVSS score of 8.6 and says Ivanti is aware of exploitation affecting a limited number of customers. CISA added it to the KEV catalog on October 13 with an October 16 due date.

Volexity tracks the attacker as UTA0576. It describes a chain of three bugs: an authentication bypass through the public welcome.cgi login page, a file upload race in wu.cgi that runs the attacker’s script, and a privilege escalation to root. The first two are covered by CVE-2026-104935. The root bug is not fixed yet; Ivanti plans to patch it in a future release.

Volexity says the attacker deleted entries from the appliance’s debug and audit logs, patched code in memory only, and did not leave a web shell. Ivanti’s Integrity Checker Tool did not detect the changes.

Ivanti Connect Secure on 22.8 and 25.1 builds

Affected builds are 22.8R2.4 and earlier, 25.1.1.1 and earlier, and 25.1.2.2 and earlier. Ivanti says 22.7 and earlier are not affected. According to Rapid7, part of the bug was already fixed in July’s 25.1.3.0, and attackers struck while Ivanti was backporting the rest.

A VPN appliance holds a service account into Active Directory. Volexity watched UTA0576 use that account to search for LAPS passwords and BitLocker keys, spray passwords and sniff LDAP traffic from a packet capture on the box. A clean integrity check does not rule any of that out.

Upgrade, then look for signs of a break-in

• Upgrade to 22.8R2.5, 25.1.1.2, or 25.1.3.0/25.1.3.1, depending on your branch.
• Rotate the Active Directory service account the appliance uses for LDAP, and any credentials stored on the box.
• If you use LAPS or store BitLocker keys in AD, check who read those attributes since October 3, and rotate local admin passwords if the appliance’s account did.
• Search web logs for the request patterns Volexity published (below). If you find them, treat it as an incident and do memory forensics, because the integrity checker will not show it.

Details

• CVE-2026-104935: Ivanti Connect Secure authentication bypass by spoofing (CWE-290), unauthenticated command execution, CVSS 8.6 (per Rapid7). CISA KEV added October 13, 2026; due October 16, 2026.
• Fixed: 22.8R2.5 (22.8R2.4 and earlier affected); 25.1.1.2 (25.1.1.1 and earlier); 25.1.3.0 or 25.1.3.1 (25.1.2.2 and earlier). 22.7 and earlier not affected.
• Still unpatched: the privilege escalation in the dsinvoked service that Volexity saw chained for root. No CVE published yet.
• Activity: exploitation from October 3, 2026 (Volexity), first investigated October 5. Attacker infrastructure named by Volexity: 108.165.147[.]64.

Hunt / verify

• Large numbers of requests to /dana-na/auth/url_default/welcome.cgi carrying an X-DSCGI-PATH header, especially one pointing at wu.cgi or /home/runtime/tmp/.
• Gaps or truncation in the appliance debug log and audit log since October 3.
• LDAP queries from the appliance’s service account for LAPS or BitLocker attributes, and password-spray patterns sourced from the appliance IP.
• Connections to 108.165.147[.]64, and the indicators on Volexity’s GitHub.

Slack paste: Ivanti Connect Secure zero-day (CVE-2026-104935) exploited since Oct 3, CISA due Oct 16. Action: upgrade to 22.8R2.5 / 25.1.1.2 / 25.1.3.x today, rotate the appliance AD service account, hunt welcome.cgi + X-DSCGI-PATH in logs.

Sources

• Ivanti: Security Advisory, Ivanti Connect Secure (CVE-2026-104935)
• Volexity: A Series of Unauthenticated Events, Chained Exploitation of Ivanti Connect Secure Zero-Days (October 13, 2026)
• Rapid7: Ivanti Connect Secure zero-day exploited in the wild (CVE-2026-104935)
• Volexity threat intel indicators (GitHub)
• CISA: Known Exploited Vulnerabilities Catalog

George Bailey

George Bailey is the byline of the CyberExperts editorial desk, the team behind the CyberExperts Daily Brief. The desk covers vulnerabilities, breaches and security news from vendor advisories, CISA alerts and other primary sources, and links those sources in every story. Questions or corrections: [email protected].