Ivanti Connect Secure Zero-Day Puts CISA Deadline Today

Attackers were running unauthenticated commands on Ivanti Connect Secure VPN appliances for at least ten days before Ivanti and the security firm Volexity went public on October 13, 2026, with a vulnerability now tracked as CVE-2026-104935. The flaw, an authentication bypass with a CVSS score of 8.6, was added to the Cybersecurity and Infrastructure Security Agency's Known Exploited Vulnerabilities (KEV) catalog the same day Ivanti disclosed it, and the federal patch deadline that CISA set for the bug falls today, October 16, 2026.

A recurring pattern for Ivanti's VPN appliances

This is not the first time Ivanti Connect Secure has made this kind of headline. In January 2024, Volexity and Ivanti disclosed a different chained pair of zero-days, CVE-2023-46805 and CVE-2024-21887, that let attackers bypass authentication — including multi-factor authentication — and run commands on the same product line, prompting a CISA alert at the time. A follow-on remote-code-execution bug, CVE-2025-0282, was added to the KEV catalog roughly a year later, in January 2025, with its own federal deadline. CVE-2026-104935 is the latest in a now-familiar string of Ivanti Connect Secure and Pulse Connect Secure flaws to land on CISA's Known Exploited Vulnerabilities catalog since that list was created in 2021. VPN and remote-access gateways sit at the edge of the network by design, which is exactly why they keep attracting this kind of attention from both sophisticated state-aligned groups and, in this case, a financially motivated newcomer.

What is CVE-2026-104935?

According to the National Vulnerability Database record, CVE-2026-104935 is an "authentication bypass by spoofing in ICS before version 25.1.3.0" that "allows a remote unauthenticated attacker to execute arbitrary commands." The entry specifically notes that ICS 22.7R2.14 and earlier builds are not affected, which matters because a lot of the public confusion this week has come from conflicting version ranges circulating in early coverage.

Under the hood, Volexity's technical write-up ties the CVE to two separate bugs that were exploited together: an authentication-bypass flaw in the appliance's welcome.cgi component and a remote-code-execution flaw in wu.cgi. Chained, the two let an attacker reach the appliance's cgi-server process without any credentials at all. CISA's own catalog entry labels the bug the "Ivanti Connect Secure Authentication Bypass by Spoofing Vulnerability" and confirms it is being used in active attacks. Ivanti's own vendor advisory, published to its support hub, is the canonical source for patch downloads and is linked directly from both the NVD and CISA entries.

How Volexity found the attack

Volexity says it opened an investigation on October 5, 2026, after spotting suspicious activity on a customer's Ivanti Connect Secure appliance. Once the researchers dug in, they traced the first exploitation to October 3 — meaning the zero-day chain was live against at least one organization for roughly a week and a half before any public fix existed. Volexity is tracking the group behind the intrusion as UTA0576, a threat actor it had not seen before and assesses, with low confidence, to be financially motivated rather than a state-aligned espionage operation.

What makes the case notable is the target: the compromised appliance was fully patched at the time of the attack, running Ivanti Connect Secure 22.8R2.4 (Build 19097) — the newest version available in that branch before Ivanti's October 13 fixes shipped. In other words, there was nothing the victim organization could have done differently with the information available to it at the time; this was a genuine zero-day in the strictest sense.

Inside the exploit chain: from anonymous request to root

Per Volexity's published research, the attack used three vulnerabilities stacked on top of each other:

• Step 1 — Authentication bypass (part of CVE-2026-104935): a flaw in welcome.cgi let the attacker skip the normal login flow entirely.
• Step 2 — Remote code execution (also covered by CVE-2026-104935): a separate bug in wu.cgi turned that unauthenticated access into the ability to run commands as the low-privileged cgi-server account.
• Step 3 — Privilege escalation (not yet assigned a CVE): a trust issue involving the dsinvoked process and the appliance's DSCache mechanism let the attacker jump from cgi-server all the way to root.

Only the first two steps are fixed as of this writing. Ivanti has told Volexity it is still working on a patch for the privilege-escalation issue and expects to ship it "in the coming weeks" — meaning even fully updated appliances today still contain one unpatched link in the chain, albeit one that on its own cannot be triggered remotely without first clearing the authentication bypass that the October 13 patches close off.

What the attacker did after breaking in

Volexity's post-exploitation findings read like a playbook for harvesting enterprise credentials rather than planting long-term malware. Once UTA0576 had root on the VPN appliance, the group reportedly:

• Extracted domain credentials the appliance used for LDAP lookups
• Queried Active Directory for Local Administrator Password Solution (LAPS) passwords, BitLocker recovery keys, and other password-bearing attributes such as userPassword and unixUserPassword
• Deployed a custom Kerberos tool capable of Kerberoasting and credential testing
• Ran password-spraying attempts against Active Directory accounts
• Captured network traffic on the appliance to harvest plaintext LDAP, HTTP Basic Auth, and NTLM credentials passing through it
• Pulled appliance configuration data and authentication logs, including valid usernames

None of this required dropping a web shell or a persistent backdoor on the device — which is precisely what made it hard to catch. It's also a reminder of how much of enterprise identity still runs on shared secrets rather than phishing-resistant credentials: LAPS passwords, BitLocker keys, and NTLM hashes are all effectively passwords, and a single compromised VPN appliance turned out to be enough to go hunting for all three. That's a different problem from the one passkeys solve for end-user logins, but it illustrates why reducing an organization's overall dependence on password-equivalent secrets matters at every layer, not just the login screen.

Why the Integrity Checker Tool didn't catch it

Ivanti has long pointed customers to its Integrity Checker Tool (ICT) as a way to spot tampering on Connect Secure appliances, including during the 2024 wave of Ivanti zero-days. UTA0576 appears to have specifically engineered its tradecraft to defeat it. According to Volexity, the attacker:

• Ran its payloads entirely in memory, executing a Python stage via exec() with no script ever written to disk
• Temporarily patched the in-memory copy of libdsplibs.so to get root, then restored both the DSCache entry and the patched memory region afterward to erase the evidence
• Deleted or filtered its own entries out of the Ivanti debug log and the Linux audit log
• Disguised a packet-capture tool as a legitimate-looking process named dsstatmond and hid its output inside the appliance's .icscap directory using rotating capture files
• Self-deleted its temporary scripts and result files after each use, then re-exploited the device from scratch for every subsequent command rather than leaving anything resident

The combination of in-memory execution, log tampering, and disguised processes meant the compromise produced almost no forensic footprint on disk — exactly the kind of indicators the Integrity Checker Tool is built to flag.

Affected and fixed Ivanti Connect Secure versions

The version ranges published to NVD line up with Volexity's own guidance to upgrade to 25.1.1.2 or later, 25.1.3.x, or 22.8R2.5. Here is the breakdown:

CVSS 3.1 vector, per NVD: AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L — network-exploitable, low attack complexity, no privileges or user interaction needed, with high confidentiality impact. CISA's own Known Exploited Vulnerabilities entry lists the same October 13, 2026 addition date and October 16, 2026 due date.

The CISA KEV listing and today's deadline

CISA's Known Exploited Vulnerabilities catalog exists specifically to flag bugs that are confirmed to be under active attack, and federal civilian agencies are required to remediate them on a schedule CISA sets. For CVE-2026-104935, that schedule is unusually tight: added October 13, due October 16 — a three-day window that falls under CISA's newer Binding Operational Directive 26-04, which replaced the older BOD 22-01 this year and allows CISA to compress remediation timelines down to three days for flaws that are internet-exposed, easily automated, and capable of giving an attacker full control of a system — all three of which apply here.

BOD 26-04 technically binds only federal agencies, but CISA's required action language — which calls on asset owners generally to "assess their internet exposure" and follow its forensic triage guidance if compromise is suspected — is effectively a recommendation every organization running Connect Secure should treat as mandatory. It is also the second time in roughly a week that a widely deployed piece of enterprise software has landed on CISA's list with an October patch deadline; Atlassian products faced a similar scramble just days earlier under a different CVE entirely.

The part that's still unpatched

It's worth repeating because it's easy to miss in the rush to patch: the authentication bypass and remote-code-execution flaws covered by CVE-2026-104935 are fixed as of October 13, 2026, but the privilege-escalation bug that turns "run commands as a low-privileged process" into "own the box as root" is not yet fixed. Ivanti has told Volexity a patch is coming in a future release, but has not given a firm date. Until that lands, applying the current patch closes the door UTA0576 used to get in, which is the single most important step, but organizations with unusually high exposure may also want to review Volexity's forensic indicators directly rather than assuming the appliance is fully hardened.

What to do now

• Patch immediately to Connect Secure 25.1.1.2, 25.1.3.0, 25.1.3.1, or 22.8R2.5, whichever applies to your branch. If you are on 22.7R2.14 or earlier, NVD's data indicates you are not affected by this specific CVE, but you should still confirm with Ivanti given how old that branch is.
• Run Ivanti's Integrity Checker Tool, but don't treat a clean result as definitive — UTA0576's in-memory, self-cleaning tradecraft was specifically designed to slip past it.
• Rotate credentials that touch the appliance, including any Active Directory service account used for LDAP, and treat LAPS passwords and BitLocker recovery keys on domain-joined systems as potentially exposed if your appliance was internet-facing and unpatched in early-to-mid October.
• Review authentication and debug logs for gaps rather than just entries — Volexity found the attacker deleted or filtered log lines rather than leaving obviously malicious ones.
• Follow CISA's forensic triage guidance referenced in the KEV entry if you have any reason to believe your appliance was exposed before the patch, rather than assuming patching alone is sufficient remediation for a device that may already have been compromised.

Volexity shared its full indicators of compromise and detection guidance with threat-intelligence subscribers ahead of the public write-up; organizations without direct access to that feed should rely on Ivanti's advisory and CISA's catalog entry for the latest confirmed guidance, since several early third-party reports this week cited inconsistent version ranges for the bug.

Written bySana Qureshi

Sana Qureshi runs the security and privacy desk. She reports on actively exploited vulnerabilities, vendor patches and data breaches, and covers the password managers, VPNs and authentication tools readers use to protect themselves. Her alerts cite vendor advisories, CISA and the CVE record directly.

More from Sana QureshiAll Security & Privacy coverage