Ivanti Connect Secure — Stealthy Attack Uncovered Using a Three Zero-Day Chain and Integrity Evasion (CVE-2026-104935)

Publication date: October 14, 2026
Category: Zero Days (realtime trigger)

Introduction

In early October 2026, cybersecurity firm Volexity identified an advanced intrusion targeting an Ivanti Connect Secure (ICS) VPN edge appliance running version 22.8R2.4, the latest build available at the time. The threat actor, tracked as UTA0576, successfully achieved unauthenticated root access through a sophisticated chain of three zero-day vulnerabilities. The operation stood out not only for its technical complexity and memory-resident persistence designed to bypass integrity checkers, but also for post-exploitation harvesting of Active Directory credentials and potential indicators of artificial intelligence assistance during exploit development.

What is CVE-2026-104935? (General Analysis)

The core affected component is the Ivanti Connect Secure gateway, engineered to provide enterprise virtual private network connectivity and remote session management. Because these gateways sit directly on the corporate perimeter, any vulnerability allowing unauthenticated remote code execution completely undermines the organization’s boundary defenses.

The NVD has formally classified part of this chain under CVE-2026-104935. Official confirmed metrics include:

  • CVSS v3.1 Base Score: 8.6 (High)
  • Official CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L
  • Official CWE Classification: CWE-290 (Authentication Bypass by Spoofing)
  • CISA KEV Catalog: Included (known active exploitation).

This vulnerability allows a remote unauthenticated attacker to execute arbitrary commands by spoofing and bypassing initial authentication controls, impacting data confidentiality while compromising system integrity and availability.

How Does It Work? (Technical Analysis)

The campaign executed by UTA0576 relied on a three-phase sequence combining an authentication bypass, a race condition for code execution, and an in-memory privilege escalation vector.

  • Initial Vector & Ingress (Authentication Bypass): The attack interacts with welcome.cgi, the public login page. The attacker sends an HTTP request that passes primary authentication checks while including the path to a protected internal script inside an HTTP header. A logical mismatch occurs: the system checks the URL against permissive validation rules but uses the header to route the destination, successfully bypassing access controls.
  • Remote Code Execution (RCE via Race Condition): After bypassing authentication, the attacker uploads a Perl script disguised as a ZIP file through a secondary endpoint. The server processes the file, determines it is not a valid archive, and schedules it for deletion. Before deletion completes, the attacker floods the predictable disk path with multiple HTTP requests. If a request reaches the file in time, the script executes. Both the bypass and the race condition flaws fall under CVE-2026-104935.
  • Privilege Escalation & Forensic Evasion: To jump from the limited web server user to full root privileges, the actor abused a background maintenance service called dsinvoked, which looks up configuration settings in a shared store to determine which programs to execute. UTA0576 patched that configuration store directly in RAM, redirecting a legitimate task to the Perl interpreter to execute commands as root. Afterward, everything was silently restored in memory. Because Ivanti’s Integrity Checker Tool only inspects files stored on persistent disk storage, no anomalies were flagged.
  • Post-Exploitation & Exfiltration: The attackers deployed no permanent backdoors or traditional web shells; instead, they repeated the entire exploit chain on demand and received output through standard HTTPS responses. They deployed a custom Python LDAP tool to query the domain controller directly, harvesting plaintext passwords, BitLocker recovery keys, and local admin passwords from Active Directory (LAPS). They also captured network traffic via renamed binaries with rotating log files, purged debug and audit logs, and operated with techniques hinting at LLM-assisted workflow automation.

Affected Systems / Environments

The flaw directly impacts edge appliances within the Ivanti Connect Secure product family.

CVE Category (CWE) Impact CVSS Vector (summary)
CVE-2026-104935 CWE-290 (Authentication Bypass by Spoofing) Remote command execution / Auth bypass 8.6 (High) AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L
  • Vulnerable Versions: ICS software builds prior to version 25.1.3.0 (specifically observed running version 22.8R2.4).
  • Exclusions: ICS version 22.7R2.14 or prior are not impacted according to vendor advisories.
  • Risk Profiles: Global enterprises, government entities, and organizations exposing VPN gateways without strict network segmentation or advanced runtime telemetry.

Mitigation and Detection

Remediation

  • Priority Patching: Immediately apply official patches and security advisories released by Ivanti to remediate the vulnerabilities in welcome.cgi and background services.
  • Independent Disk Validation: Acknowledge that native disk-hash integrity checkers (such as Ivanti’s Integrity Checker Tool) can provide a false sense of security due to volatile in-memory patching by advanced threat actors.
  • Least-Privilege Access: Strictly restrict administrative access to the VPN management interfaces, limiting exposure strictly to internal managed networks via secure tunnels or certified jump hosts.

Detection

  • Memory and Network Monitoring: Look out for anomalous LDAP traffic patterns originating directly from the VPN appliance toward internal domain controllers.
  • Audit Log Verification: Search for temporal gaps or missing entries in Linux debug logs and system audit trails on perimeter devices.

“In-memory persistence and immediate configuration state restoration demonstrate that traditional disk-hash based reviews are insufficient against sophisticated threat actors operating without permanent file artifacts.”

Wrapping Up

The intrusion campaign conducted by threat actor UTA0576 against Ivanti Connect Secure devices via CVE-2026-104935 highlights the continuous evolution of attacks targeting critical perimeter infrastructure. The ability to chain authentication bypasses, race-condition code execution, and volatile memory modifications while evading integrity tools emphasizes the urgent need for defense-in-depth strategies, advanced memory visibility, and prompt vendor patch management.

References