A three-zero-day chain cracks Ivanti Connect Secure to root and leaves no trace

October 13, 2026. Ivanti publishes an advisory for CVE-2026-104935, an authentication bypass in its Connect Secure VPN gateways, and CISA adds it to the KEV catalog the same day. October 5, 2026. Volexity opens an investigation and finds an unknown actor, tracked as UTA0576, abusing a chain of three zero-days against an appliance that was “fully patched” at 22.8R2.4. October 3, 2026. The first exploitation is observed, two days before the investigation begins. Why it matters: the chain takes an unauthenticated attacker all the way to root without dropping a single web shell, and the traces are wiped so cleanly that the vendor’s integrity tool sees nothing.

Three links from anonymity to root

What stands out in the Volexity report is that this is not one isolated flaw. It is a methodical chain of three separate vulnerabilities, each one opening the door to the next.

First link, the authentication bypass. The request lands on /dana-na/auth/url_default/welcome.cgi, a public login page. The attacker adds an X-DSCGI-PATH header pointing at a normally protected script, wu.cgi. Connect Secure decides authorization from the URL but destination from the header — the bypass makes the first lie for the benefit of the second.

Second link, remote code execution. wu.cgi computes the MD5 hash of the supplied filename, writes the uploaded content to /home/runtime/tmp/<MD5>, and only checks afterward that it is a valid ZIP. A Perl script disguised as a .zip fails that check and is deleted — but it exists on disk for a short window. UTA0576 exploits the race by sending parallel requests that execute the script before the deletion lands.

Third link, privilege escalation. The code first runs in the cgi-server context. To reach root, the attacker patches the library /home/lib/libdsplibs.so in memory, rewrites the DSCache configuration store so that a maintenance task of the privileged dsinvoked service launches the Perl interpreter instead of its legitimate script, then restores the original state the moment root execution succeeds. Ivanti tracks the first two links under CVE-2026-104935; the third, the privilege escalation, remains unpatched, with a fix promised “in the coming weeks.”

Anti-forensics that blinds the integrity tool

The detail that should wake up any CISO is how clean the crime scene is. UTA0576 deploys neither a backdoor nor a web shell: for every command, it re-runs the full chain and receives the result directly in the HTTPS response, with no separate C2 channel.

The privilege-escalation stage goes further. After each root execution, the script restores the DSCache entry and the libdsplibs.so library to their pre-exploitation state, then removes the matching entries from two targeted logs: /home/runtime/dlogs/debuglog and /var/log/audit/audit.log. The result is that Ivanti itself concedes its Integrity Checker Tool — built to spot unexpected file modifications — detects nothing, because everything happens in memory and the on-disk state is restored.

The practical consequence is harsh: patching does not clear an appliance. Only a forensic analysis of memory and disk can confirm that a gateway was not compromised. Volexity had to collect memory images, disk images, and core dumps to reconstruct the chain — that is the level of effort required to see what the vendor’s tool cannot.

What the attacker came for

UTA0576 was not after the gateway itself but the Active Directory behind it. The post-exploitation activity documented by Volexity traces a precise focus on administrative secrets.

The actor extracted domain credentials stored on the appliance for LDAP authentication, exfiltrated Active Directory metadata, and deployed a custom Kerberos tool capable of Kerberoast attacks and credential testing. A purpose-built Python LDAP tool then searched, through the compromised AD service account, for LAPS local-administrator passwords, BitLocker recovery keys, and secret-bearing attributes such as userPassword and unixUserPassword.

On top of that came password spraying, packet capture of LDAP traffic, and inspection of authentication logs to map valid usernames. The single objective was to turn an exposed VPN appliance into a launch point toward domain control. Results, compressed into Base64, were exfiltrated through the exploit channel itself.

How to tell if you have been hit

Ivanti said at the time of the advisory that reliable indicators of compromise were not available on its side — a direct consequence of the anti-forensics described above. Volexity, however, published a set of indicators on its threat-intel GitHub repository, dated October 13, 2026.

Detection therefore cannot rely on finding a malicious file on disk: there is none. The signals to watch are behavioral. Lateral-movement attempts originating from the VPN appliance toward Active Directory, unusual LDAP queries from the appliance’s service account, searches for LAPS or BitLocker attributes in the directory, or Kerberoast activity — mass service-ticket requests — are all symptoms of this kind of compromise.

For teams that suspect an intrusion, Ivanti points to its recovery procedures: factory-reset the appliance and rebuild from a clean configuration, rather than trying to “clean” a machine whose integrity cannot be proven. That is the logical consequence of traceless root exploitation: once trust in the machine is destroyed, the only safe remediation is rebuild.

The fix, and what it does not cover

Ivanti lists patched versions on October 13, 2026: 25.1.1.1 and earlier to 25.1.1.2, 25.1.2.2 and earlier to 25.1.3.0 or 25.1.3.1, and 22.8R2.4 and earlier to 22.8R2.5. Versions 22.7.x and below are unaffected. Rapid7 recommends applying the update “on an emergency basis outside of normal patching cycles.”

Two nuances make this more uncomfortable than a simple “patch and move on.” First, the privilege-escalation link is not yet patched: even an up-to-date appliance stays potentially exploitable if an attacker holds another path to code execution. Second, Ivanti says part of the vulnerability was found through its product security program and fixed in the 25.1.3.0 release of July 2026, but that exploitation happened while the fix was being backported to the remaining supported branches. That is the feared zero-day scenario: a window between internal knowledge of the bug and its public correction.

This campaign fits a documented series. In January 2024, the pair CVE-2023-46805 (authentication bypass) and CVE-2024-21887 (command injection) already hit Connect Secure, chained by a China-linked actor. In January 2025, CVE-2025-0282, a buffer overflow, was exploited as a zero-day on the same appliances. Three straight years, three times the same pattern: an exposed VPN appliance turned into a front door to the domain. A VPN remains an attacker’s preferred entry point precisely because it is meant to be a legitimate door.

Verdict

If you run Ivanti Connect Secure, apply the CVE-2026-104935 fix tonight, out of band, on the affected 25.1.1.x, 25.1.2.x, and 22.8R2.x branches. But do not stop there: no appliance should be cleared on the strength of the Integrity Checker Tool alone. Have exposed gateways audited for the indicators Volexity published — lateral-movement attempts originating from the appliance, LAPS or BitLocker searches, abnormal LDAP queries — and watch for the privilege-escalation fix, because one piece of the puzzle is still missing. If you cannot rule out being targeted, the rule is simple: with root-level exploitation that leaves no detectable trace, treat every edge appliance as potentially compromised until forensic evidence says otherwise.

References

• Volexity — A Series of Unauthenticated Events: Chained Exploitation of Ivanti Connect Secure Zero-Days, October 13, 2026
• Ivanti — Security Advisory CVE-2026-104935, October 13, 2026
• Rapid7 — Ivanti Connect Secure zero-day exploited in the wild (CVE-2026-104935), October 13, 2026
• CISA — Known Exploited Vulnerabilities Catalog