Critical vulnerabilities in Ivanti Connect Secure VPN appliances are being actively exploited, enabling attackers to gain unauthenticated root access. The flaws, which compromise stored credentials and sensitive Active Directory data, were confirmed in limited customer environments. Ivanti issued additional patches on October 29, 2026, building on fixes from earlier in the month. Investigation by firm Volexity revealed a fully patched appliance was compromised as early as October 3. The appliance was updated but remained vulnerable even in version 22.8R2.4 (Build 19097).
How the Exploit Chain Works
The attackers leveraged multiple zero-day vulnerabilities. The sequence began with an authentication bypass in the public welcome.cgi login script, exploiting a mismatch between the requested URL and the X-DSCGI-PATH header to reach a protected upload handler without valid credentials. The handler (wu.cgi) accepts uploads and writes them to a predictable temporary location; the attacker slipped a Perl script in, then sent simultaneous requests to trigger its execution before cleanup could occur. This resulted in code execution under the appliance’s cgi-server user.
Privilege escalation followed. The exploits subverted the dsinvoked service by altering memory-based library code and manipulating the DSCache maintenance task defined in the configuration store. That let the attackers run code as root. After executing, the exploit restored settings and memory to mask changes and restore normal operation.
Damage and Data Exposure
Once root access was obtained, attackers extracted domain credentials from the appliance and leveraged the Active Directory service account to access internal systems. The breach exposed Windows LAPS administrator passwords, BitLocker recovery keys, and password-related attributes in AD. The attack also involved collecting usernames, conducting packet analysis to capture credentials in transit, and (in some cases) performing password spraying. Importantly, the attackers did not install a backdoor or web shell; instead they repeatedly reused the exploit chain and obtained responses via HTTPS, minimizing disk footprint.
Patch Details & Detection Advice
Ivanti has designated these vulnerabilities as CVE-2026-104935 (authentication bypass), CVE-2026-111357 (privilege escalation), and CVE-2026-118527 (predictable filename vulnerability). Affected branches have been fixed in versions 25.1.1.3 and 22.8R2.6. Administrators are urged to follow Ivanti’s advisory and deploy the proper upgrade for their appliance. Even after patching, detection requires more than checking file integrity. Since the exploit makes memory-only changes and restores settings to cover tracks, defenders need to conduct memory, disk, and network analysis.
Signs that may indicate compromise include abnormal welcome.cgi traffic, discrepancies between request paths and headers, unexpected files in /tmp/, or unusual connections from the VPN appliance into internal systems. Clean integrity checks may miss the attack — memory and logs may have been manipulated or erased to hide the exploit.
These exploits have been tracked under the threat actor UTA0576. Volexity monitoring began on October 3, and a live compromise was identified on October 5 in a fully patched device. Ivanti’s October 29 fixes aim to close all disclosed paths of attack on the monitored branches.
Understanding the scale of VPN vulnerabilities: Ivanti Connect Secure appliances serve as gateway devices for enterprise remote access, often integrated with Active Directory. A breach here doesn’t just compromise the appliance—it can escalate into deeper access across internal networks, especially when BitLocker keys, AD credentials, and other sensitive secrets are exposed. In this case, the layered exploit chain and temporary stealth techniques meant attackers could evade many typical defenses.
What to Watch: For defenders, ensuring baseline detection isn’t enough. When dealing with zero-days that leave few footprints, proactive threat hunting—especially in memory and across network traffic—is essential. Administrators must test that upgrades to 25.1.1.3 or 22.8R2.6 are applied correctly. For organizations using Ivanti Connect Secure, this incident reveals a broader lesson: gateway security must be seen as an urgent anchor in any enterprise cyber posture.
