Key points
- Threat actor UTA0576 used a three-vulnerability chain to execute commands as root on Ivanti Connect Secure appliances.
- Ivanti released fixes for the authentication bypass and remote code execution tracked as CVE-2026-104935.
- A separate privilege escalation flaw in the dsinvoked service currently lacks a confirmed patch.
Ivanti Connect Secure versions 22.8R2.4 and earlier, along with specific 25.1 releases, are affected by a chain of three zero-day vulnerabilities. Ivanti has released updates for the authentication bypass and remote code execution components, tracked as CVE-2026-104935. However, the vendor stated it is still working on a fix for the final privilege escalation weakness in the chain.
In plain English
Attackers exploited a flaw in the welcome.cgi endpoint to bypass login requirements. According to Volexity, this allowed them to reach the wu.cgi upload handler. They uploaded a disguised script that executed before deletion, granting code execution as the cgi-server user. A subsequent payload then exploited a weakness in the dsinvoked service to elevate privileges to root.
The background
Volexity attributed the activity to threat actor UTA0576, which targeted an appliance running version 22.8R2.4. The actor collected credentials and Active Directory data before cleaning logs to hide evidence. The US Cybersecurity and Infrastructure Security Agency added CVE-2026-104935 to its known exploited vulnerabilities catalog on October 13. As Patch Herald reported on 2026-10-14, one flaw in this chain remains unpatched.
What changes now
Ivanti confirmed that exploitation affected a limited number of customers at the time of disclosure. The vendor advised organizations to upgrade to fixed releases such as 22.8R2.5 or 25.1.3.1. Security teams should also check for indicators of compromise shared by Volexity and run the Integrity Checker Tool regularly to detect unexpected file modifications on disk.
Who needs to act first
Teams should prioritize updating appliances that face the internet, as these are most exposed to the initial authentication bypass. Before applying patches, create full system backups to ensure recovery if an update fails. Test the new software in a non-production environment to verify compatibility with existing configurations. Monitor network traffic for unusual outbound connections that might indicate credential theft or lateral movement attempts.
What to do and how to stay safe: Ivanti Connect Secure
- Verify your current Ivanti Connect Secure version against the list of affected releases provided by the vendor.
- Apply the available patch for CVE-2026-104935 to stop the initial unauthenticated access vector.
- Review system logs for signs of the specific cleanup activities described by Volexity, such as deleted temporary scripts.
- Monitor network traffic for unauthorized access to Active Directory or credential storage systems.
Step-by-step guide: Phishing Risks and Protection for Small Business Operations
General security guidance from the Patch Herald newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Which Ivanti versions are affected by this exploit chain?
Ivanti Connect Secure 22.8R2.4 and earlier, as well as specified 25.1 releases, are affected. Versions 22.7 and earlier are not impacted.
Is there a complete fix for all three vulnerabilities?
No. Ivanti has released fixes for the authentication bypass and remote code execution (CVE-2026-104935), but is still working on a fix for the privilege escalation component.
Who is behind these attacks?
Volexity attributed the activity to an unknown threat actor it tracks as UTA0576.
