Ivanti Connect Secure Zero-Day Chain: Three CVEs, Root on a Patched Appliance, and a Fix for the Root Step That Arrived 16 Days Late
Update (2026-10-31): We have now read Ivanti's own advisory (created October 13, updated October 29). Fixed builds: for CVE-2026-104935, 25.1.1.2, 25.1.3.0 or 25.1.3.1, and 22.8R2.5. For CVE-2026-111357 and CVE-2026-118527, 25.1.1.3 and 22.8R2.6, both released October 29. Ivanti recommends 25.1.1.3 or later and says 22.8R2.6 resolves all three, so CVE-2026-118527 was fixed in the same October 29 builds as the root step. Ivanti rates the three at CVSS 8.6, 8.8 and 4.3, and says 25.1.3.0 and later, released in July for the ISA4500, ISA6500 and ISA8500, do not contain the vulnerability. Where this note differs from the text below on fixed builds or the fix for 118527, this note is correct. Nothing else in this post has been changed.
If you run Ivanti Connect Secure, the October 13 patch is not the whole fix. The attacker chain Volexity documented ends in root through a separate flaw, CVE-2026-111357, and Ivanti did not patch that one until October 29. CISA added it to its Known Exploited Vulnerabilities catalog on October 30, alongside CVE-2026-118527.
What Volexity found
Volexity published "A Series of Unauthenticated Events" on October 13. It describes an actor it tracks as UTA0576 chaining three flaws against Ivanti Connect Secure to get unauthenticated, root-level code execution. Volexity says exploitation started on October 3, 2026, and that the attacker landed on appliances running 22.8R2.4, which was the latest build at the time.
The chain has three steps:
Front door. An authentication bypass in the welcome.cgi handler routes a request to an arbitrary CGI file, including ones that normally require a login.
File write. The wu.cgi upload handler writes the uploaded file to disk before it checks whether it is a valid ZIP. A race between execution and deletion turns that into code execution as the cgi-server user. Volexity says the attacker uploaded a Perl script with a .zip extension.
Root. The dsinvoked broker trusts DSCache configuration data. The exploit patches libdsplibs.so in memory, runs commands as root and then restores it.
Volexity assesses with low confidence that the motive is criminal rather than espionage. It saw the actor go after LAPS passwords, BitLocker recovery keys and domain LDAP credentials. There was no backdoor and no web shell. The attacker sent every command through the exploit's own HTTPS requests, and deleted the debug and audit logs.
Three CVE numbers, two catalog dates
Volexity says the authentication bypass and the RCE are both tracked as CVE-2026-104935, and that the privilege escalation is CVE-2026-111357. CISA's catalog splits it differently:
CVE-2026-104935, listed October 13: authentication bypass that lets a remote unauthenticated attacker execute commands.
CVE-2026-118527, listed October 30: predictable identifiers that let an authenticated attacker upload files with attacker-controlled content to a known location on disk. CISA's entry says it chains with the other two.
CVE-2026-111357, listed October 30: a missing authentication check that lets a local authenticated attacker escalate privileges. This is the root step.
We could not reconcile Volexity's grouping with CISA's, and we did not read Ivanti's advisory. What we can say is that all three numbers belong to one chain, and the catalog's own text says so.
The patch gap
Volexity's October 13 post says the first fix shipped that day. Its update says Ivanti patched the privilege escalation on October 29. For 16 days, an appliance with the October 13 fix applied still had a root step available to anyone who could get code running as the cgi-server user by another route. The attacker described above got there with a zero-day. A different attacker might get there with the next bug.
We did not confirm a fix date for CVE-2026-118527. Fixed build numbers vary across the secondary sources we read, so take them from Ivanti's advisory and not from us.
How to check an appliance
Ivanti's Integrity Checker Tool did not detect this activity, according to Volexity, so a clean result from it is not an all-clear. Volexity recommends the following:
Monitor for large numbers of requests to /dana-na/auth/url_default/welcome.cgi.
Look for requests where the URL path does not match the X-DSCGI-PATH header. The upload step sets that header to the wu.cgi path.
Check /tmp for scripts such as ml.py, rq5.py and mk.py, and look for a hidden /data/.icscap directory containing packet captures and a renamed tcpdump binary called dsstatmond.
Treat missing or truncated debug and audit logs as evidence, not as quiet. The actor deleted both.
If you suspect a compromise, do network and memory forensics. The root exploit patches a library only in memory.
If an appliance was exposed between October 3 and its patch date, assume LAPS passwords, BitLocker keys and domain LDAP credentials reachable from it are exposed, and rotate them.
What we hold, and what we did today
Volexity's GitHub folder lists one network indicator and one file hash. We hold both as of this morning, credited to Volexity and not presented as our own sighting.
108.165.147.64, the UTA0576 exploitation address, an Evoxt VPS that ran an OpenVPN server from September 30 to October 7. We first ingested it on October 16 at confidence 75 from Volexity's report, which is an ingest of their work three days after they published. Today we re-ingested it at confidence 85 with the actor attached.
25b95f47359c327e3a5ae5ac5cd147f8d9afd98092faf136822ee287e25e3dc8, listed in Volexity's YARA rule as the Python implementation of the privilege escalation. It is 64 hex characters, but Volexity does not name the algorithm. We ingested it today at confidence 85, and a lookup by that value returns it.
Neither is a detection lead. Volexity found this, and our timestamps are later than theirs.
On our own edge, we had no Ivanti canary on the /dana-na/ path family until after the October 13 listing, according to our own gap analysis from that day. It exists now. Since October 29 it has recorded zero hits across 1,818 canary documents, and our edge blocked 2,301 requests in that window without one matching /dana-na/. That is a measurement over a short window, not evidence that nobody is scanning.
Limits
The chain, dates, request path, header and file locations come from Volexity's post and its published IOC folder, which we read today. Catalog dates and descriptions come from CISA's entries as indexed in our own corpus. We did not test any exploit and did not read Ivanti's advisory, so fixed versions are not stated here. The CISA federal deadline for the October 13 listing is reported in secondary sources and we did not verify it.
Five percent of this is wrong somewhere. It always is.
Was this useful? Rate this post. The widget is at the bottom of the page, and we read every response.
Every indicator in this post is in the feed. Free.
1.58M+ IOCs, STIX 2.1 / TAXII, 88% novel vs ThreatFox, exploited-CVE leads ahead of CISA. No credit card — a free API key in 30 seconds, and you can audit every claim above against the live endpoints.
Comments