Ivanti ICS Zero-Day Attacks Highlight Vendor Patching Hurdles

1. Executive summary

Ivanti Connect Secure (ICS) is being exploited in the wild through a zero-day chain that gives a remote, unauthenticated attacker arbitrary command execution and then root on the appliance. The authentication bypass and RCE components are tracked as CVE-2026-104935 (CVSS 8.6 HIGH, CWE-290 authentication bypass by spoofing); CISA added it to the Known Exploited Vulnerabilities catalog on 2026-10-13 with a remediation due date of 2026-10-16, and EPSS sits at 26%. A fully patched appliance (22.8R2.4, Build 19097) was compromised, and the third bug in the chain, a privilege escalation flaw, has no patch yet. For EMEA financial services, ICS is an edge VPN concentrator: successful exploitation puts the attacker inside the corporate network with access to Active Directory credentials, LAPS passwords and BitLocker recovery keys, which is a direct path to domain-wide compromise.

2. Regulatory framing

3. Technical analysis & attack chain

Volexity detected the activity on 2026-10-05 at a Network Security Monitoring customer and traced it to an ICS VPN appliance running 22.8R2.4, Build 19097, which was fully patched at the time. Exploitation began on 2026-10-03. The chain combines three vulnerabilities to reach unauthenticated root-level code execution. Ivanti tracks the authentication bypass and the RCE under CVE-2026-104935; the privilege escalation bug is separate and unpatched, with Ivanti stating a fix is planned "in the coming weeks."

Confirmed chain, in order:

1. Authentication bypass. The first exploit targets how the ICS appliance routes requests from front-end and back-end processes to a CGI script handler. This is the component tracked as CVE-2026-104935 (CWE-290, authentication bypass by spoofing).
2. Remote code execution via wu.cgi. The RCE portion of the chain sits in wu.cgi. UTA0576 used it to upload and execute a Perl script.
3. Staged in-memory payload. The Perl script executes a Bash script, which executes a Python script. The Python script is delivered Base64-encoded and zlib-compressed, then decompressed, decoded and run via exec(), so the raw script exists only in memory and never touches disk.
4. Privilege escalation to root. The escalation exploit is passed inside that in-memory Python script. It takes the attacker from code execution as the cgi-server user to root. This bug is not covered by CVE-2026-104935 and has no patch at the time of writing.
5. Command execution loop. For every command UTA0576 ran, the entire exploit chain was re-executed and the result returned over the exploit channel's HTTPS requests.

Post-exploitation, from Volexity's forensics:

• Credential and secret theft. The actor targeted Active Directory credentials and secrets, specifically LAPS passwords and BitLocker recovery keys.
• No implant. UTA0576 deployed no malware and no web shell. It used only commands available on the ICS appliance, passing commands and results through the exploit chain's HTTPS requests instead of a separate C2 channel.
• Anti-forensics. The actor deleted evidence of exploitation from Ivanti debug logs and Linux audit logs. Volexity had to collect memory and disk images and analyse core dumps generated by the exploitation to reconstruct the chain.
• Intent. Volexity assesses with high confidence that UTA0576's actions signalled preparation for lateral movement and a broader compromise of the victim network. The operation was detected and disrupted, so the ultimate objectives could not be determined.

Patch history and the partial fix. Ivanti says it discovered a portion of this vulnerability through its product security program and patched it in the July 2026 release of 25.1.3.0, then worked on backporting the fix to remaining supported versions. Attackers began exploiting before that backport work finished. This is the third consecutive year ICS has seen in-the-wild zero-day exploitation, following January 2025 and January 2024.

Affected and resolved versions (from the vendor advisory via Rapid7):

Versions 22.7.x and below are unaffected.

Attribution and confidence caveats. UTA0576 was previously unknown to Volexity and is not a tracked MITRE ATT&CK actor; the attribution is unconfirmed and rests on a single vendor's investigation. Volexity suspects criminal motive rather than espionage, and suspects the attackers used large language models, pointing to repeated use of the exploit channel to run commands rather than deploying web shells and to "highly specific scripts using hardcoded credentials." Both the motive assessment and the LLM claim are single-sourced and speculative; treat them as leads, not findings. The technical chain itself is corroborated across Volexity, Rapid7, The Register and the CISA KEV entry. Note one discrepancy: the source text describes the flaw as an authentication bypass plus RCE, while the verified reference classifies it as CWE-290 authentication bypass by spoofing; both describe the same access-granting flaw and the verified classification stands. The CISA KEV entry records known ransomware campaign use as "Unknown," so nothing in this item supports a ransomware characterisation.

4. Mitigation & containment

P1, within 24 hours:

• Patch ICS to the resolved version for your code line: 25.1.1.2, 25.1.3.0 or 25.1.3.1, or 22.8R2.5. Rapid7 recommends applying the update on an emergency basis outside normal patching cycles. The CISA KEV due date is 2026-10-16.
• Treat patching as insufficient on its own. The privilege escalation bug in the chain is unpatched, so a patched appliance can still be escalated if the attacker already has a foothold. Hunt for compromise before and after patching.
• Run the Ivanti Integrity Checker Tool, which the vendor advises running regularly.
• If you suspect exploitation, follow Ivanti's recovery steps rather than simply rebooting the appliance.
• Isolate any ICS appliance showing signs of compromise, in particular attempts to move laterally originating from the VPN device, and forensically investigate before returning it to service.

P2, within 72 hours:

• Reconstruct the exploitation timeline from memory and disk images and from core dumps, because UTA0576 deleted Ivanti debug logs and Linux audit logs. Standard log review will not show the intrusion.
• Rotate and reissue every credential and secret the appliance could reach: Active Directory service and user credentials, LAPS passwords, and BitLocker recovery keys. Assume exposure if the appliance was reachable and unpatched during the exploitation window.
• Review Active Directory for authentication from the ICS appliance's network position and for use of any credential that transited it.
• Restrict management and administrative access to the ICS appliance to a dedicated management network, not the general corporate estate.

P3, within 7 days:

• Assess exposure to CVE-2026-104935 with your vulnerability scanner; Rapid7 shipped a check in its October 14 content release for Exposure Command, Vulnerability Management and Nexpose customers.
• Decide whether the appliance needs to remain internet-facing given an unpatched privilege escalation component in the same chain, and document the compensating controls if it does.
• Track Ivanti's forthcoming fix for the privilege escalation bug and schedule it as an emergency change when it lands.

5. Indicators of compromise

Ivanti states that reliable indicators of compromise were not available at the time of its advisory; Volexity published several. The atomic indicators below are not reproduced here because the source material provided does not contain the specific values. What is available is behavioural.

Behavioural indicators:

No atomic indicators are available in the source material, so no copyable indicator block is provided. The Volexity report is the authoritative source for the IOC set; retrieve it directly before enforcement.

6. Detection

The source material does not contain distinctive strings, command-line flags, mutex names, file names, registry keys or hard-coded values from the malicious artefacts themselves. The technical detail available describes the mechanism (wu.cgi, the Perl to Bash to Python staging, exec() of an in-memory script, cgi-server to root escalation) but not the literal strings an attacker's payload contains. A YARA rule built from product names, CVE identifiers or the actor name would detect reporting about the threat, not the threat.

Insufficient indicators to author detection rules.

Detection effort should instead go to the behavioural indicators in §5: alert on process trees on the ICS appliance where a Perl interpreter spawns Bash which spawns Python, on any process running as cgi-server that subsequently gains root, on outbound HTTPS from the appliance carrying command output, and on gaps in Ivanti debug and Linux audit log continuity.

CVE assessment

1 referenced CVE — 1 actively exploited (CISA KEV)

7. Sources

• Dark Reading, "Ivanti ICS Zero-Day Attacks Highlight Vendor Patching Hurdles", https://www.darkreading.com/vulnerabilities-threats/ivanti-ics-zero-day-attacks-vendor-patching, 2026-10-14.
• The Register, "Ivanti patches Connect Secure zero-day after researchers confirm in-the-wild attacks", https://www.theregister.com/security/2026/10/14/ivanti-patches-connect-secure-zero-day-after-researchers-confirm-in-the-wild-attacks/5303095, 2026-10-14.
• Rapid7, "Ivanti Connect Secure zero-day exploited in the wild (CVE-2026-104935)", https://www.rapid7.com/blog/post/etr-ivanti-connect-secure-zero-day-exploited-in-the-wild-cve-2026-104935, 2026-10-13.
• Volexity, "A Series of Unauthenticated Events: Chained Exploitation of Ivanti Connect Secure Zero-Days", https://www.volexity.com/blog/2026/10/13/a-series-of-unauthenticated-events-chained-exploitation-of-ivanti-connect-secure-zero-days/, 2026-10-13.
• SecurityWeek, "Ivanti Zero-Day Chain Gave Attackers Root Access to Fully Patched VPN", https://www.securityweek.com/ivanti-zero-day-chain-gave-attackers-root-access-to-fully-patched-vpn/, 2026-10-14.
• ANSSI CERT-FR, "Multiples vulnérabilités dans les produits Ivanti", https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-1311/, 2026-10-14.
• CISA Known Exploited Vulnerabilities, CVE-2026-104935, https://nvd.nist.gov/vuln/detail/CVE-2026-104935, added 2026-10-13.

8. Adverse Trace position

Adverse Trace assesses CVE-2026-104935 as a P1 for any EMEA financial services client running Ivanti Connect Secure on the network edge. The verified severity is CVSS 8.6 HIGH, it is in CISA KEV with a 2026-10-16 remediation due date, and EPSS is 26%. The risk is not the CVSS number; it is that a fully patched appliance was compromised, that the chain includes an unpatched privilege escalation bug, and that the post-exploitation target set (Active Directory credentials, LAPS passwords, BitLocker recovery keys) is exactly what an attacker needs to move from the edge into the domain. The attribution to UTA0576 is unconfirmed and single-sourced to Volexity, and the motive and LLM claims are speculative; we are not treating them as established. We will track Ivanti's forthcoming fix for the privilege escalation component and issue a follow-up when it ships, and we will re-issue if Volexity or Ivanti publish atomic indicators that support detection content. Clients who cannot confirm their ICS version and patch state within 24 hours should contact us.

Read the original source →

Published via PulseTrace — Adverse Trace threat intelligence.