Ivanti Connect Secure — Attacker Chains Three Zero-Days for Root Access (CVE-2026-104935)

Publication date: October 13, 2026
Category: Vulnerability / Enterprise Security

Introduction

A threat actor tracked as UTA0576 has executed active exploitation campaigns leveraging a sophisticated chain of three zero-day vulnerabilities in Ivanti Connect Secure VPN appliances. Reported by security firm Volexity, the attacks successfully bypassed authentication mechanisms and achieved arbitrary command execution with superuser (root) privileges on an appliance running version 22.8R2.4 with all current patches applied. While Ivanti has issued emergency updates addressing two of the flaws in the chain, a fix for the critical privilege escalation component is still under development.

What is Ivanti Connect Secure and the Exploit Chain? (General Analysis)

Ivanti Connect Secure is an enterprise-grade virtual private network (VPN) and secure gateway solution deployed at the network perimeter. Because these appliances handle inbound sessions and gateway connectivity, any successful compromise exposes internal corporate networks to full external infiltration.

The campaign relies on a multi-stage flaw sequence. The primary entry point is tracked as CVE-2026-104935, which combines an authentication bypass and a remote code execution vulnerability. According to official NVD data, this vulnerability carries an official CVSS vector of CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L, a score of 8.6 (HIGH), and corresponds to CWE-290 (Authentication Bypass by Spoofing). Furthermore, it has been officially incorporated into CISA’s Known Exploited Vulnerabilities (KEV) catalog.

In the same security advisory cycle, Ivanti disclosed critical vulnerabilities affecting other enterprise products:

  • CVE-2026-106042: A flaw in Ivanti Xtraction with an official CVSS score of 9.9 (CRITICAL) (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) categorized under CWE-73 (External Control of File Name or Path).
  • CVE-2026-109412: An exposed dangerous endpoint in Ivanti Neurons Patch for Intune, rated 9.9 (CRITICAL) (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) under CWE-749 (Exposed Dangerous Method or Function).

How Does It Work? (Technical Analysis)

Forensic investigation into the incident unveiled a highly evasive and methodical attack pattern:

  • Initial Access and Auth Bypass: The actor (UTA0576) initiated compromise by transmitting high volumes of requests to the appliance web server endpoint /dana-na/auth/url_default/welcome.cgi. These requests included an X-DSCGI-PATH HTTP header containing values mismatched with the requested URL, successfully bypassing perimeter access controls without valid credentials.
  • Code Execution and Privilege Escalation: Utilizing the first two components of CVE-2026-104935, the attacker executed code under the context of the cgi-server user. They then chained a third privilege escalation vulnerability (pending a specific CVE and vendor patch) to escalate privileges to full root access.
  • In-Memory Persistence and Evasion: To sidestep detection by Ivanti’s native Integrity Checker Tool, the exploit selectively modified library code exclusively within system RAM while restoring any altered configuration files on disk. The attacker left behind no static web shells or backdoors, re-running the entire exploit chain for every individual command issued.
  • Post-Exploitation Activity: Once inside, the threat actor harvested stored credentials (including LDAP domain hashes), queried Active Directory for account details, and conducted password-spraying attacks against internal accounts.

Affected Systems / Environments

Impacted software versions pertain specifically to the enterprise gateway ecosystem.

CVE / Identifier Category (CWE) Impact CVSS Vector (summarized)
CVE-2026-104935 CWE-290 Remote Code Execution / Bypass 8.6 (HIGH) AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L
CVE-2026-106042 CWE-73 Request Redirection / Credential Theft 9.9 (CRITICAL) AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
CVE-2026-109412 CWE-749 Authentication Info Leakage 9.9 (CRITICAL) AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Ivanti Connect Secure Version Scope:

  • Affected: Connect Secure “before version 25.1.3.0”.
  • Unaffected: Version 22.7R2.14 or prior, as well as builds 22.8R2.5, 25.1.3.0, and 25.1.3.1.

Mitigation and Detection

Remediation

  • Immediate Patching: Administrators operating vulnerable Ivanti Connect Secure instances must upgrade immediately to build 25.1.3.1 or later following official vendor advisories.
  • Patch Tracking: Closely monitor Ivanti security advisories for the forthcoming release addressing the remaining privilege escalation vector.
  • Perimeter Hardening: Enforce strict access control lists (ACLs) and robust multi-factor authentication (MFA) to restrict exposure of administrative and user portals.

Detection

  • Memory Forensics: Because native disk-based integrity checkers may fail to flag modifications restricted to volatile memory, defenders must rely on advanced memory analysis and network forensics.
  • Indicators of Compromise (IoCs):
    • High-frequency request patterns directed at: /dana-na/auth/url_default/welcome.cgi
    • Anomalous HTTP header: X-DSCGI-PATH with path mismatch.
    • Presence of artifact directory: /data/.icscap/
    • Attacker source IP address: 108.165.147[.]64

“The threat actor executed the full exploitation chain entirely in memory without leaving static files or web shells behind, bypassing traditional disk-based integrity scanners and necessitating advanced incident response procedures.”

Wrapping Up

The active exploitation of the zero-day chain against Ivanti Connect Secure by UTA0576 highlights the growing sophistication of threats targeting enterprise perimeter appliances. The ability to operate ephemerally within system memory while circumventing automated integrity checks demonstrates the critical need for continuous runtime monitoring and aggressive patching protocols across all network infrastructure.

References