Ivanti Connect Secure zero-day chain (CVE-2026-104935, CVE-2026-111357, CVE-2026-118527) gave root on fully patched VPNs

What happened

Volexity found a previously unknown actor, UTA0576, exploiting Ivanti Connect Secure (ICS) from 3 October 2026. The victim ran ICS 22.8R2.4, which was fully patched at the time (Volexity). Defused said it first saw signs of exploitation on 1 October (BleepingComputer).

The chain has three steps (Volexity):

1. Authentication bypass. The public endpoint /dana-na/auth/url_default/welcome.cgi routes a request to a protected CGI script named in an X-DSCGI-PATH header, while the access check looks only at the URL.
2. File write and code execution. The upload handler wu.cgi writes a file to disk before it checks the file is a valid ZIP. The attacker races parallel requests to run the file before it is deleted.
3. Root. The exploit patches libdsplibs.so in memory, changes a DSCache maintenance task, and gets the root dsinvoked service to run its script. It then restores both.

Ivanti’s CVE record says CVE-2026-104935 is an authentication bypass that lets a remote unauthenticated attacker run arbitrary commands. It affects ICS before 25.1.3.0; 22.7R2.14 and earlier are not affected (CVE record). CVE-2026-111357 is the dsinvoked and DSCache privilege escalation to root (CVE record). CVE-2026-118527 is a predictable-identifier flaw that lets an authenticated attacker upload attacker-controlled files to a known location on disk (CISA KEV).

The fix came in two parts. Ivanti disclosed CVE-2026-104935 first, on 13 October, because its fix was already in QA, and added the other CVEs once they were found (Security Affairs). Volexity updated its post on 29 October when Ivanti patched the privilege escalation. CISA added CVE-2026-104935 to KEV on 13 October (due 16 October), and CVE-2026-111357 and CVE-2026-118527 on 30 October (due 2 and 13 November) (CISA KEV).

What the attacker did. UTA0576 installed no web shell or backdoor. It re-ran the whole chain for every command. It went after Active Directory: LDAP queries for LAPS passwords, BitLocker recovery keys and password attributes, Kerberoasting, password spraying, and packet capture of LDAP traffic on the appliance. It also tampered with logs (Volexity).

Shadowserver tracked over 5,500 exposed ICS instances when the bug was disclosed (BleepingComputer).

Am I affected?

CISA lists ICS 25.1.1.2 and earlier, 25.1.2.2 and earlier, and 22.8R2.5 and earlier as affected (CISA). The Canadian Centre for Cyber Security lists the fixed builds as 25.1.1.3, 25.1.3.1 and 22.8R2.6 (Cyber Centre), which matches Security Affairs’ reading of Ivanti’s update. Ivanti’s own advisory page did not load for us; confirm the build for your branch there before you upgrade.

Check the version shown in the ICS admin console against those numbers. A box upgraded to 25.1.3.0 on 13 October is fixed for the authentication bypass but not for the full chain.

Do not rely on the Integrity Checker Tool (ICT). Because the exploit patches libraries in memory and restores the configuration, Volexity found the ICT “does not detect any modifications” (Volexity). CISA says network and memory forensics are needed (CISA).

Indicators from Volexity:

• Source IP 108.165.147[.]64.
• High volumes of requests to /dana-na/auth/url_default/welcome.cgi, and requests whose X-DSCGI-PATH header does not match the URL. Seen values: X-DSCGI-PATH: /home/webserver/htdocs/dana/fb/smb/wu.cgi and X-DSCGI-PATH: /home/runtime/tmp/<MD5 of filename>.
• Files on the appliance (for a forensic image or Ivanti support): /tmp/ml.py, /tmp/rq5.py, /tmp/mk.py, /tmp/rr.py, /tmp/sp_run.py, /tmp/sp_out.txt, /tmp/spray_hits.json, /tmp/pu.txt, /data/.icscap/h.py, /data/.icscap/cap*, /home/runtime/tmp/ics-root-run-inband-*.pl and /home/runtime/tmp/ics-root-result-inband-*.
• A renamed tcpdump running as /data/.icscap/dsstatmond.
• Gaps or edits in /home/runtime/dlogs/debuglog and /var/log/audit/audit.log.

Volexity publishes further indicators in its threat-intel repository.

What to do now

1. Upgrade to 25.1.3.1, 25.1.1.3 or 22.8R2.6 or later, after checking the exact build for your branch in Ivanti’s advisory. CISA points to Ivanti’s 25.x upgrade and compatibility guide for hardware and virtual appliances, and notes ICS 22.8 reaches end of life on 31 January 2027 (CISA).
2. If compromise is possible, follow CISA’s recovery steps: back up the configuration, factory reset (or rebuild a virtual instance), upgrade, then restore the configuration (CISA).
3. Reset what the appliance could reach. CISA says to reset passwords for all domain, administrator and local accounts, revoke and reissue stored certificates, and reset stored API keys and license server credentials. Given what UTA0576 targeted, also rotate LAPS-managed local admin passwords and BitLocker recovery keys that are readable from AD, and service account passwords that could be Kerberoasted.
4. Search your web and proxy logs in front of the appliance for welcome.cgi bursts and X-DSCGI-PATH headers from 1 October onward, and block 108.165.147[.]64.
5. Look inside your network, not just on the box. Volexity says devices showing lateral movement from the VPN appliance “should be forensically investigated.” Check domain controllers for LDAP queries and Kerberos service ticket requests sourced from the ICS internal IP.

Sources

• Volexity: chained exploitation of Ivanti Connect Secure zero-days (13 October 2026, updated 29 October)
• CISA: urges patching newly exploited vulnerabilities in Ivanti Connect Secure (revised 30 October 2026)
• Canadian Centre for Cyber Security: Ivanti security advisory AV26-1035
• CVE record: CVE-2026-104935
• CVE record: CVE-2026-111357
• BleepingComputer: Ivanti warns of Connect Secure zero-day exploited in attacks
• Security Affairs: CISA adds Ivanti Connect Secure flaws to KEV
• CISA Known Exploited Vulnerabilities catalog
• Ivanti security advisory for CVE-2026-104935