senn-techIvanti Connect Secure: three flaws add up to root on a patched VPN appliance
On 13 October 2026 Ivanti released updates for Connect Secure, CISA added the vulnerability CVE-2026-104935 to its catalogue of exploited flaws the same day, and Volexity described how attackers chained three vulnerabilities. The appliance on which Volexity found the chain was, by its own account, fully patched, on the then-current version 22.8R2.4. This post rests entirely on the sources below. We made no measurement of our own for it.
The chain in three links
Volexity attributes the activity to the group UTA0576. The first trace dates from 3 October 2026, and the investigation began on 5 October. The chain has three links.
The first is an authentication bypass in welcome.cgi, a public login script. A request can name a protected CGI file in the X-DSCGI-PATH header. The URL is checked for access, but the header decides where the request actually goes.
The second link writes a file and runs it. In wu.cgi an uploaded archive lands on disk before anyone checks that it is a ZIP. The attacker starts it in the short window before deletion, a race condition. Both links fall under CVE-2026-104935.
The third link turns code execution into root. The broker dsinvoked trusts configuration data from DSCache. The attacker patches libdsplibs.so in memory so that a maintenance task with root rights starts a Perl interpreter. Volexity names no CVE for this link, and Ivanti is still working on a fix according to Volexity and Rapid7, expected in the coming weeks.
Affected versions and fixes
The table gives what Rapid7 takes from Ivanti's advisory. CISA names the same upper limits for the affected versions.
| Affected up to and including | Fixed in |
|---|---|
| 25.1.1.1 | 25.1.1.2 |
| 25.1.2.2 | 25.1.3.0 and 25.1.3.1 |
| 22.8R2.4 | 22.8R2.5 |
The branches 22.7.x and older are not affected according to the vendor. Rapid7 gives the rating as CVSS 8.6. By Ivanti part of the fix is already in the July release 25.1.3.0, and exploitation began while Ivanti was carrying the fix over to the other branches. Version 22.8 ends on 31 January 2027 according to CISA.
How to recognise a takeover
Ivanti's Integrity Checker did not find the activity because the commands run in memory. CISA advises network and memory forensics if in doubt. Volexity lists these traces, which can be searched for in logs and on the appliance:
- Many requests to
/dana-na/auth/url_default/welcome.cgiwhereX-DSCGI-PATHpoints towu.cgior to a file under/home/runtime/tmp/, or where the URL and the header path do not match. - Files in
/tmp/, among themml.py,rq5.py,mk.py,rr.py,pu.txt,sp_out.txtandspray_hits.json. - A process
dsstatmond, a renamed tcpdump from the hidden directory/data/.icscap/. - Gaps in or tampering with
/home/runtime/dlogs/debuglogand/var/log/audit/audit.log.
Volexity rates the group with low confidence as financially motivated, and with medium confidence as a user of language models for exploit development and follow-up work. That is an assessment in the report, not an established fact.
What operators do now
- Check the version and update to a fixed version, outside the normal patch cycle.
- Look for the traces above, also after the update, because the fix does not clean up an appliance that was already taken over.
- If in doubt, follow CISA's instruction: back up the configuration, reset the appliance to factory settings and rebuild it or rebuild virtual instances, restore the configuration, change all passwords, reissue stored certificates and renew API keys and credentials for the licence server.
- Restrict access to the management and login interface as far as operations allow until the third link is fixed too.
- Anyone still running 22.8 plans the migration, because the branch ends on 31 January 2027.
What forums say
We searched Hacker News. It has one submission of the Volexity report with 2 points and no comment (post). There is no technical discussion there, and for the statements above the vendor and researcher sources are authoritative.
How we checked
On 16 October 2026 we read the Volexity report, the CISA alert, the Rapid7 post and the Help Net Security report and compared them with each other. One discrepancy: Help Net Security gives 1 October for the start of activity and Rapid7 says early October, while Volexity names 3 October, and we follow Volexity. We did not read Ivanti's own advisory, and the version table comes from Rapid7 and the CISA alert.
Further reading
Primary sources
- Volexity, Chained Exploitation of Ivanti Connect Secure Zero-Days, 13 October 2026
- CISA, Urges Patching Newly Exploited Vulnerability in Ivanti Connect Secure, 13 October 2026
Independent reports
- Rapid7, Ivanti Connect Secure zero-day exploited in the wild (CVE-2026-104935), 13 October 2026
- Help Net Security, Attackers chained three Ivanti zero-days to gain root on fully patched VPN appliances, 14 October 2026
Community
- Hacker News, 2 points, no comment on 16 October 2026: news.ycombinator.com/item?id=50079288
Is updating to the fixed version enough?+
For the first two links of the chain yes. They fall under CVE-2026-104935 and are fixed in 25.1.1.2, 25.1.3.0 or 25.1.3.1 and 22.8R2.5. The third link, the privilege escalation to root, had no fix at the time of the reports. A patched appliance that was attacked earlier also stays compromised until it has been reset.
How do I recognise a takeover?+
Ivanti's Integrity Checker did not detect the activity because the commands run in memory. Volexity lists traces: many requests to welcome.cgi with an X-DSCGI-PATH header that does not match the URL, files such as ml.py and rq5.py in /tmp, a process called dsstatmond and gaps in the logs. Only network and memory forensics give certainty.
Which versions are affected?+
By Ivanti's advisory as Rapid7 reproduces it: 25.1.1.1 and earlier, 25.1.2.2 and earlier and 22.8R2.4 and earlier. According to the vendor the branches 22.7.x and older are not affected. Version 22.8 reaches end of life on 31 January 2027.