Ivanti Connect Secure zero-day exploited, one of the patches still pending

On October 13, 2026, Ivanti released a patch for CVE-2026-104935, an already exploited vulnerability in its Connect Secure (ICS) VPN gateway. According to the vendor, exploitation remains "limited." The same day, the US cybersecurity agency (CISA) added the flaw to its Known Exploited Vulnerabilities (KEV) catalog. Federal agencies have until October 16 to patch.

A chain of three vulnerabilities

The company Volexity discovered the attack and reported it to Ivanti. It has been tracking a threat actor it calls UTA0576 since at least October 3. According to BleepingComputer, the company Defused saw the first attempts as early as October 1. The attacker chains three vulnerabilities to run commands with root privileges, without authentication, on fully up-to-date devices:

• an authentication bypass via the X-DSCGI-PATH header of the welcome.cgi page;
• code execution tied to a file that is written before it is verified;
• a privilege escalation to root.

CVE-2026-104935 covers the first two flaws. The third has not been patched yet: according to Volexity, the fix will come in a later release.

A stealthy attack focused on Active Directory

According to Volexity, the attacker installed no malware or backdoor. They re-run the exploit for each command, tamper with logs and delete their files. Ivanti's Integrity Checker Tool did not detect these changes. Once on the gateway, the attacker extracted domain credentials used for LDAP, targeted LAPS passwords and BitLocker recovery keys (Volexity does not know whether each operation succeeded), and tried to obtain other passwords (“Kerberoasting,” password spraying). Volexity assesses with medium confidence that the attacker is using large language models. It assesses with low confidence that the motives are criminal rather than espionage-related. Shadowserver counts more than 5,500 ICS instances exposed on the internet, though it is unknown how many are vulnerable.

What to do

• Identify the affected versions: 22.8R2.4 and earlier, 25.1.1.1 and earlier, 25.1.2.2 and earlier.
• Update without delay. According to information relayed from Ivanti's advisory, the fixed versions are 22.8R2.5, 25.1.1.2, 25.1.3.0 and 25.1.3.1.
• Do not rely on the Integrity Checker alone: look in /tmp/ for unknown Python scripts, a hidden /data/.icscap directory or a dsstatmond process.
• Monitor requests to welcome.cgi where the X-DSCGI-PATH header does not match the requested path. Volexity publishes its indicators on GitHub.
• If in doubt, treat the directory as compromised: change AD service account passwords and LAPS passwords, rotate BitLocker keys, and look for connections from the gateway to the internal network.