Ivanti Connect Secure zero-day chain: unauthenticated root on fully patched VPN boxes, again
Attacker UTA0576 chained an auth bypass, a file write and a privilege escalation to take over VPN appliances running the latest release, then went after AD credentials, LAPS passwords and BitLocker keys. CISA added it to KEV the same day.
Send one magic header to skip the login, write a file through an update CGI, then use a local bug to become root: three steps, zero passwords, on the box that guards your network.
Volexity found the attacker, tracked as UTA0576, on a Connect Secure appliance running 22.8R2.4, the latest version at the time. The chain:
X-DSCGI-PATH headerwu.cgi (1 and 2 together are CVE-2026-104935, CVSS 8.6)dsinvoked, which has no public CVE and was still unpatched at disclosureThe attacker left no web shell. It simply re-exploited the box for every command and tampered with logs to get past Ivanti’s internal Integrity Checker. From there it went after LDAP/AD credentials, LAPS passwords and BitLocker keys, and ran Kerberoasting.
Volexity has medium confidence that the actor used LLMs to build its tooling, and low confidence that it is criminal rather than espionage. Ivanti’s own advisory was not reachable for our review. The fixed-version list comes from secondary press, so double-check it against Ivanti’s portal.
CVE-2026-104935CVSS 8.6Covers two of the three chained bugs: an authentication bypass via the X-DSCGI-PATH header and a file write in wu.cgi that leads to code execution.
In plain poop: the bouncer lets in anyone wearing a lanyard, and the lanyard is printed on the door.
| Product | Safe from | Note |
|---|---|---|
| Ivanti Connect Secure 22.8 | 22.8R2.5 | |
| Ivanti Connect Secure 25.1 | 25.1.1.2 / 25.1.3.0 / 25.1.3.1 | |
| Privilege escalation in dsinvoked | none | No CVE, no patch at disclosure. Fix promised “in coming weeks” |
Oct 1, 2026
Earliest exploitation
According to Defused Cyber honeypots and Volexity's Koessel. Volexity's blog says Oct 3.
Oct 5, 2026
Volexity starts investigating a compromised appliance
The box ran 22.8R2.4, the latest release at the time.
Oct 13, 2026
Ivanti patches; Volexity publishes; CISA adds it to KEV
Oct 14, 2026
Previdian logs 105 exploit attempts from 50 IPs
Oct 16, 2026
CISA deadline for US federal agencies
We list each claim and who made it. Primary sources (the vendor, the researcher, the registry) are marked. Where reports disagree, we grade by the worst credible case.