A newly disclosed vulnerability in Ivanti Connect Secure is being exploited by an unidentified threat actor to seize complete control of corporate VPN appliances, even on systems administrators believed were fully updated. Ivanti confirmed on October 13, 2026, that CVE-2026-104935, rated 8.6 on the severity scale, is being used in live attacks, and the U.S. Cybersecurity and Infrastructure Security Agency has since ordered federal agencies to patch by October 16.
How attackers turned a routing quirk into root access
The intrusion came to light only because the security firm Volexity happened to investigate an Ivanti Connect Secure appliance running the latest patched build at the time. What it found was a remarkably disciplined attack chain. The threat actor, tracked as UTA0576, discovered that the appliance's publicly reachable welcome page could be manipulated through an HTTP header, X-DSCGI-PATH, that silently redirected requests to a protected upload handler normally reserved for authenticated users. By exploiting the gap between how the system checks access permissions and how it actually routes requests, the attacker reached a file-upload function and slipped in a disguised Perl script during the brief window before the appliance deleted it as invalid. That was enough to execute code under a low-privileged service account.
From there, the attacker chained a second, still-unpatched flaw in a privileged background process to escalate from that limited foothold to full root access - the kind of access that, in effect, hands over the entire machine. Notably, the attackers left almost no footprint on disk, since key stages of the exploit ran in memory and were deliberately unwound afterward, along with entries scrubbed from debug and audit logs.
Why this attack is harder to catch than most
Ivanti's Integrity Checker Tool, the standard defense recommended to customers, is built to flag unexpected changes to files on disk. This attack was engineered to avoid exactly that kind of detection. Because the exploitation chain modified memory rather than installing a persistent backdoor or web shell, the attacker had to repeat the entire multi-stage intrusion every time a new command was needed, retrieving output directly through encrypted web traffic rather than through any planted implant. That approach trades convenience for stealth, and in this case, stealth won.
Once inside with root privileges, the operators moved methodically: harvesting credentials stored on the appliance, querying Active Directory, hunting for Windows LAPS passwords and BitLocker recovery keys, running password-spraying attempts, and capturing LDAP traffic. This is the classic playbook for lateral movement - turning a single compromised internet-facing device into a foothold across an entire internal network. Volexity assesses with only low confidence that the motive was criminal rather than espionage-driven, and separately suggests, with medium confidence, that large language models may have assisted the attacker in building or refining parts of the exploit.
What organizations need to do now
Ivanti has shipped fixes for the authentication bypass and code-execution components across its supported branches, with specific corrected builds including 22.8R2.5, 25.1.1.2, 25.1.3.0, and 25.1.3.1 depending on the deployed version. The company is urging customers still on the 22.x line to move to 25.x, since that older branch is nearing its end of support. Critically, the privilege-escalation flaw used alongside CVE-2026-104935 remains unpatched, which means blocking the initial entry point is currently the only reliable way to prevent the full chain from working.
Security teams should not treat a clean Integrity Checker scan as proof of safety, given how this exploit was specifically designed to leave minimal disk evidence. Recommended steps include:
- Updating Connect Secure to the applicable fixed release without delay
- Monitoring HTTP logs for mismatches between requested URLs and X-DSCGI-PATH header values, particularly references to wu.cgi or temporary files
- Inspecting /tmp/ directories for unexplained scripts or staged reconnaissance data
- Reviewing Active Directory for anomalous LDAP queries, password-spraying patterns, or access to LAPS and BitLocker attributes
- Rotating credentials potentially exposed through the appliance, including LDAP service accounts
Known indicators from the investigated intrusion include the IP address 108.165.147.64 and suspicious activity around the /data/.icscap/ directory, though defenders should treat these as supplementary to behavioral monitoring rather than a complete blocklist, since infrastructure and filenames can be changed easily. Given how exposed VPN gateways sit at the perimeter of nearly every corporate network, this incident is a reminder that patching alone, however urgent, needs to be paired with network-level visibility and memory forensics capable of catching what disk-based tools miss.