An Ivanti Connect Secure Chain Turns a Spoofed Request Into Root Access

TL;DR

• Ivanti Connect Secure is a VPN and remote-access appliance that a company runs at its own network edge, and CVE-2026-104935 is the identifier Ivanti assigned to an authentication bypass and a code-execution flaw in it.
• An attacker chained that bypass with a file write and a privilege escalation to reach root on an appliance running 22.8R2.4, a build that was fully patched when the exploitation started on 3 October 2026.
• The ten days from exploitation to disclosure ended on 13 October, when Ivanti published fixes and Volexity published the incident report.
• The first two links sit together in one CVE at 8.6 on the CVSS scale, and the privilege escalation that finishes the chain has no patch yet, with a fix promised for a future release.
• The credentials the chain collects are the ones an appliance keeps so it can query the corporate directory: LDAP service credentials, LAPS local-administrator passwords and BitLocker recovery keys.
• A customer-facing integrity checker reports a clean file system after this chain, because the exploit patches a library in memory and restores the configuration store before it leaves.
• Read as a maintenance plan, the fix arrived in the newest code line first: part of the flaw was patched in the July 2026 release of 25.1.3.0 while Ivanti backported the fix to older supported lines.

What the chain does to a fully patched appliance

The appliance sits between the internet and the internal network, terminates the remote-access tunnels employees use, and authenticates against the corporate directory. That position explains why the device holds credentials at all, and why the 8.6 rating covers two links of a three-link chain.

Volexity's account of the incident is unusually complete. The first link abuses how the appliance routes requests from its front-end processes to a CGI handler: a request to the public login script carries a header, X-DSCGI-PATH, that names the script the request is actually delivered to. The URL decides whether the request is allowed, and the header decides where it lands, so an unauthenticated request reaches a script that assumes a trusted caller.

The second link turns that reach into a file write. The upload handler hashes the client-supplied filename, writes the content to a path built from that hash, and only then checks whether the payload is a valid archive. A Perl script sent with a .zip name lands on disk, fails the check, and is scheduled for deletion, which leaves a short interval in which the file exists and a parallel request can execute it. Volexity's write-up describes the payload running as the CGI server user and holding its Python stage only in memory.

The ten days from exploitation to disclosure

Exploitation began on 3 October 2026, the investigation opened on 5 October, and the advisory landed on 13 October with fixes attached to it. The appliance was running version 22.8R2.4 build 19097, which Volexity describes as fully patched at the time.

Rapid7's analysis of the advisory adds a detail that matters for anyone planning maintenance. Part of the flaw was initially discovered through Ivanti's product security program and patched in the July 2026 release of 25.1.3.0, and the team was backporting that fix to the remaining supported code lines when exploitation occurred. A fix sitting in the newest code line while older supported lines wait for a backport is a normal engineering situation and an uncomfortable security one, because the maintenance branch is exactly where conservative operators live.

Where the credentials go once the chain reaches root

Root on a remote-access appliance hands the attacker the credentials the device holds. The device authenticates users against the directory, which means it holds a service account with read access to that directory, and often stores configuration data linking it to other systems.

The research describes a custom LDAP tool searching the domain directory for Windows LAPS local-administrator passwords, BitLocker recovery keys, attributes holding userPassword and unixUserPassword values, and logon script paths, with results written to the appliance's temporary storage and exfiltrated through the same HTTPS channel as the commands. A separate Kerberos tool supported Kerberoasting attacks and credential testing, and the packet capture function was pointed at port 389, the LDAP port.

The privilege escalation that has no patch yet

The chain finishes with a flaw that has no CVE attached and no fix published. The appliance runs a privileged background service called dsinvoked, which performs maintenance tasks as root and looks up the program for each task in DSCache, a shared configuration store. The exploit patches the CGI server process's in-memory copy of an Ivanti library so that store can be edited, reconfigures an existing maintenance task to launch the Perl interpreter, and asks the service to run it.

A privilege escalation that runs at the end of an otherwise ordinary maintenance path points, in our reading, at the broker's trust model itself, and Ivanti has not described how its later fix will change it. Until the promised release arrives, the honest position is that patching closes the first two links and leaves the finish available to an attacker who already has code execution on the appliance.

The integrity checker's blind spot

Ivanti publishes an Integrity Checker Tool that looks for unexpected file modifications on disk, and the advisory recommends running it. The research is direct about its limit on this incident: the chain patches library code in memory and restores the configuration store to its pre-exploitation state afterwards, so the tool reports nothing to investigate.

The same section describes the cleanup that covers the remaining traces, with entries removed from the appliance debug log and from the Linux audit log. A clean checker result therefore describes the disk, and the CISA entry for this CVE requires forensic triage because that result does not rule out a compromise.

Fixed builds and the link still open

Ivanti's fix table names four resolved versions: 25.1.1.2, 25.1.3.0, 25.1.3.1 and 22.8R2.5. The affected builds are 25.1.1.1 and earlier, 25.1.2.2 and earlier and 22.8R2.4 and earlier, and the 22.7 line and below are unaffected. Each code line has its own fixed build, so match yours against Ivanti's table before scheduling the window.

Rapid7 advises organisations on affected versions to apply the update on an emergency basis, outside normal patching cycles. The privilege escalation stays open until Ivanti ships its later fix, so the update closes the entry point and the rest of the work is checking for prior use.

The federal clock is shorter. CISA added the CVE to its Known Exploited Vulnerabilities catalogue on 13 October with a due date of 16 October, and the entry requires forensic triage under BOD 26-04. The listing lands in a crowded month: Ivanti's October 2026 Patch Tuesday post counts more than 406,000 CVEs in its knowledge base, with 2026 disclosures already 64 per cent above the full 2025 total and exploited vulnerabilities 33 per cent above it, and the same round-up lists exploited edge-appliance flaws in Citrix NetScaler and FortiMail next to this one. That deadline governs federal civilian agencies, and the reasoning behind it travels: for a public-facing appliance that already ran a full patch level, the checklist that matters is exposure, evidence of use, and the credentials the device can reach. For the monitoring part of that checklist, Netics offers infrastructure monitoring and plain-language alerts, and the broader patch-queue argument sits in our reading of how CISA's five legacy flaws changed the order of the same list.

Sources

Source: Security Advisory Ivanti Connect Secure (CVE-2026-104935) — hub.ivanti.com, Ivanti security advisory, article 000109571, published 13 October 2026, retrieved 2026-10-15 (CVE-2026-104935 as an authentication bypass by spoofing in ICS before version 25.1.3.0 allowing a remote unauthenticated attacker to execute arbitrary commands, rated 8.6 High with vector CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L and weakness CWE-290; affected versions 25.1.1.1 and prior, 25.1.2.2 and prior and 22.8R2.4 and prior; resolved in 25.1.1.2, 25.1.3.0, 25.1.3.1 and 22.8R2.5; versions 22.7R2.14 and prior unaffected; limited exploitation affecting a limited number of customers at the time of disclosure, limited indicators of compromise and the recommendation to run the Integrity Checker Tool; the partial fix in the July release 25.1.3.0 and the backport in progress when exploitation occurred).

Source: A Series of Unauthenticated Events: Chained Exploitation of Ivanti Connect Secure Zero-Days — volexity.com, Volexity incident report, 13 October 2026, retrieved 2026-10-15 (an unknown threat actor tracked as UTA0576 on an appliance running 22.8R2.4 build 19097 that was fully patched at the time; exploitation from 3 October and an investigation opened on 5 October; the authentication bypass in welcome.cgi routing requests through the X-DSCGI-PATH header; the wu.cgi file write to /home/runtime/tmp/ ahead of archive validation and execution inside the deletion window; the privilege escalation through DSCache and the dsinvoked broker, with in-memory patching of libdsplibs.so and verification by reading /etc/shadow; the Integrity Checker Tool detecting no modification; log entries removed from /home/runtime/dlogs/debuglog and /var/log/audit/audit.log; no backdoor or web shell, with commands returned through the exploit's HTTPS requests; extraction of credentials stored on the appliance, a custom Kerberos tool for Kerberoasting, a Python LDAP tool searching for LAPS credentials, BitLocker recovery information and password-bearing attributes, packet capture of LDAP traffic on port 389 and password spraying; a separate fix for the privilege escalation reserved for a future release).

Source: October 2026 Patch Tuesday — ivanti.com, Ivanti blog, updated 13 October 2026, retrieved 2026-10-15 (more than 406,000 CVEs tracked and over 78,000 disclosed in 2026; disclosure in 2026 exceeding the full 2025 total by 64 per cent as of 12 October, exploitation 33 per cent higher and patching at 94 per cent of the 2025 total and on pace to finish around 20 per cent higher; edge devices and appliances dominating the weeks before Patch Tuesday; the CVE-2026-104935 fix versions and the note that a fix for the related privilege escalation is due in the coming weeks).

Source: CISA Adds Two Known Exploited Vulnerabilities to Catalog, 13 October 2026, and the Known Exploited Vulnerabilities catalogue feed, version 2026.10.15, retrieved 2026-10-15 — cisa.gov (CVE-2026-104935 and the Microsoft Windows Shell command injection CVE-2026-96951 added on 13 October 2026 with a due date of 16 October, forensic triage required, unknown ransomware campaign use and BOD 26-04 as the governing directive; the catalogue at 1,746 entries).

Source: CVE Record CVE-2026-104935 — cve.org, CVE Program record published 13 October 2026 by the CNA Ivanti, retrieved 2026-10-15 (the advisory description and the CWE-290 classification). Source: Ivanti Connect Secure zero-day exploited in the wild (CVE-2026-104935) — rapid7.com, Rapid7 analysis, 13 October 2026, retrieved 2026-10-17 (the 8.6 score and vector, affected and resolved versions, 22.7.x unaffected, part of the flaw found through Ivanti's product security program and patched in the July 2026 release of 25.1.3.0, the backport under way during exploitation, and the emergency-update advice).

Source: Ivanti's advisory and Patch Tuesday post, Volexity's incident report and the CISA records cited above — the versions, dates, figures and chain details used in this article, retrieved 2026-10-15. Images are an official Ivanti graphic and a Volexity page capture, plus two Netics editorial diagrams.