Ivanti patches Connect Secure zero-day after researchers confirm in-the-wild attacks

1. Executive summary

Ivanti has released out-of-band fixes for CVE-2026-104935, an authentication bypass by spoofing (CWE-290) in Connect Secure (ICS) that carries a CVSS of 8.6 HIGH and allows a remote, unauthenticated attacker to execute arbitrary commands. CISA added the CVE to its Known Exploited Vulnerabilities catalog on 2026-10-13, the same day as vendor disclosure, with a remediation due date of 2026-10-16. Volexity attributes the intrusions to a previously unknown actor it tracks as UTA0576, which chained the bypass with a remote code execution flaw and a separate, still-unpatched privilege escalation bug to reach root on a fully patched ICS appliance (22.8R2.4, Build 19097). UTA0576 has no MITRE ATT&CK profile in our reference data, so the attribution is unconfirmed; Volexity suspects criminal rather than espionage motive and reports no malware or web shell deployed. For EMEA financial services, any internet-facing ICS appliance is an unauthenticated remote code execution target with confirmed exploitation and a two-day federal remediation clock, and the credential and secret theft Volexity observed (Active Directory, LAPS passwords, BitLocker recovery keys) is directly relevant to identity and recovery infrastructure.

2. Regulatory framing

No specific UK NIS 2018 duty is engaged by the facts in this item beyond the general OES# Advisory AT-2026-10-14-1328: Ivanti patches Connect Secure zero-day after researchers confirm in-the-wild attacks

1. Executive summary

Ivanti has released out-of-band fixes for CVE-2026-104935, an authentication bypass by spoofing (CWE-290) in Connect Secure (ICS) that carries a CVSS of 8.6 HIGH and allows a remote, unauthenticated attacker to execute arbitrary commands. CISA added the CVE to its Known Exploited Vulnerabilities catalog on 2026-10-13, the same day as vendor disclosure, with a remediation due date of 2026-10-16. Volexity attributes the intrusions to a previously unknown actor it tracks as UTA0576, which chained the bypass with a remote code execution flaw and a separate, still-unpatched privilege escalation bug to reach root on a fully patched ICS appliance (22.8R2.4, Build 19097). UTA0576 has no MITRE ATT&CK profile in our reference data, so the attribution is unconfirmed; Volexity suspects criminal rather than espionage motive and reports no malware or web shell deployed. For EMEA financial services, any internet-facing ICS appliance is an unauthenticated remote code execution target with confirmed exploitation and a two-day federal remediation clock, and the credential and secret theft Volexity observed (Active Directory, LAPS passwords, BitLocker recovery keys) is directly relevant to identity and recovery infrastructure.

2. Regulatory framing

No specific UK NIS 2018 duty is engaged by the facts in this item beyond the general OES/RDSP obligations that apply to any incident affecting a network and information system.

3. Technical analysis & attack chain

Volexity observed UTA0576 exploiting a three-vulnerability chain against a fully patched ICS appliance (22.8R2.4, Build 19097) beginning 2026-10-03, with investigation starting 2026-10-05. Ivanti tracks the authentication bypass and RCE components under CVE-2026-104935; the privilege escalation component is separate and unpatched at the time of writing.

Confirmed attack chain:

1. UTA0576 sends requests to the ICS appliance that abuse how the device routes requests from front-end and back-end processes to a CGI script handler. This is the authentication bypass stage.
2. The RCE stage is reached through wu.cgi. The attacker uploads and executes a Perl script.
3. The Perl script executes a Bash script, which in turn executes a Python script.
4. The Python script is delivered Base64-encoded and zlib-compressed. It is decompressed, decoded, and executed via exec(), so the raw script exists only in memory and is never written to disk.
5. The Python script carries the privilege escalation exploit, which is passed through the in-memory execution path. Successful exploitation yields root.
6. For each command UTA0576 runs, the entire exploit chain is re-executed. Command results are returned through the exploit chain's HTTPS requests rather than a separate command-and-control channel.

Post-exploitation actions Volexity observed:

• Credential and secret theft targeting Active Directory, including Local Administrator Password Solution (LAPS) passwords and BitLocker recovery keys.
• Data exfiltration and network reconnaissance.
• Log tampering: UTA0576 deleted evidence of exploitation from Ivanti debug logs and Linux audit logs.
• No malware and no web shell were deployed. The actor used only commands available on the ICS appliance.

Ivanti states a portion of the vulnerability was identified through its product security program and patched in the July 2026 25.1.3.0 release, and that backporting to remaining supported versions was still in progress when exploitation began. Affected and resolved versions:

Versions 22.7.x and below are unaffected.

Caveated and single-sourced claims. The attribution to UTA0576, the criminal-motive assessment, the LLM suspicion, and the full exploit-chain reconstruction all rest on Volexity's report, which is a single source. Volexity's own assessment that the actor was preparing for lateral movement and broader network compromise is stated as high confidence by Volexity but is not corroborated by a second vendor in the material available to us. The LLM claim in particular is an inference from the actor's tradecraft (repeated use of the exploit channel instead of web shells, and highly specific scripts using hardcoded credentials) and should not be treated as established. The third vulnerability, the privilege escalation bug, has no CVE assigned in the sources and no patch date beyond "in the coming weeks." The Hacker News headline references 105 exploit attempts logged by honeypots; that figure is not corroborated in the other sources and we do not rely on it.

Discrepancy note: the source text describes the flaw as an authentication bypass and the verified reference data classifies it as CWE-290 (Authentication Bypass by Spoofing); Rapid7's write-up uses the same CWE-290 classification, so there is no conflict on the weakness type. The CVSS of 8.6 HIGH is consistent across the verified data and the sources.

4. Mitigation & containment

P1 (within 24 hours):

• Identify every internet-facing ICS appliance and determine its version. Any device on 25.1.1.1 or earlier, 25.1.2.2 or earlier, or 22.8R2.4 or earlier in the applicable code line is in scope.
• Upgrade to the resolved version for the code line: 25.1.1.2, 25.1.3.0 or 25.1.3.1, or 22.8R2.5. Treat this as emergency change, outside the normal patching cycle, given confirmed exploitation and the CISA KEV due date of 2026-10-16.
• Run the Ivanti Integrity Checker Tool on every ICS appliance, as Ivanti advises. Note that the vendor states reliable indicators of compromise were not available at the time of its advisory, so a clean integrity check is not proof of no compromise.
• Because UTA0576 deleted Ivanti debug logs and Linux audit logs, do not rely on appliance logs alone to rule out compromise. Preserve memory and disk images of any suspect appliance before remediation, following the approach Volexity used (memory and disk collection plus core dumps generated during exploitation).
• Rotate credentials and secrets that an ICS appliance can reach: Active Directory service and privileged accounts, LAPS passwords, and BitLocker recovery keys. Volexity observed all three being targeted.

P2 (within 72 hours):

• Hunt for lateral movement originating from ICS appliances, which Volexity names as the sign that should trigger forensic investigation.
• Review authentication and access logs for the ICS appliance and for downstream systems for activity from 2026-10-03 onward, the start of observed exploitation.
• If compromise is confirmed, follow Ivanti's recovery steps and treat the appliance as untrusted until rebuilt or verified.
• Track the unpatched privilege escalation vulnerability. Ivanti plans a fix "in the coming weeks"; until it ships, a patched appliance still carries an unpatched escalation path that UTA0576 used in this chain.

P3 (within 7 days):

• Where ICS exposure cannot be remediated immediately, evaluate whether the appliance can be taken offline or restricted to known source ranges. CISA's KEV guidance permits discontinuing use of the product if mitigations are unavailable.
• Confirm that detection coverage exists for command execution on the ICS appliance itself, since the actor used only on-box commands and no separate C2 channel.

5. Indicators of compromise

Ivanti states that reliable indicators of compromise were not available at the time of its advisory. Volexity published several; the specific atomic values are not reproduced in the material available to us. No atomic indicators (hashes, domains, IPs, file paths) are present in the sources provided.

No indicators of compromise available in the source material.

Behavioural indicators:

6. Detection

The sources give usable artefacts for a Sigma rule: the wu.cgi component, the Perl-to-Bash-to-Python execution chain, and the in-memory Python execution via exec(). No file hashes, mutexes, or hardcoded strings from the malicious files themselves are present, so a YARA rule built on threat artefacts cannot be written without inventing strings. The Sigma rule below keys on the process behaviour Volexity described.

title: Ivanti Connect Secure wu.cgi Exploit Chain Process Behaviour
id: 8f3c2a91-4d7e-4b1a-9c2e-6a5f0d3b7e21
status: experimental
description: Detects the Perl to Bash to Python execution chain Volexity observed UTA0576 using against Ivanti Connect Secure wu.cgi during exploitation of CVE-2026-104935.
author: Adverse Trace
date: 2026-10-14
references:

  - https://www.volexity.com/blog/2026/10/13/a-series-of-unauthenticated-events-chained-exploitation-of-ivanti-connect-secure-zero-days/
  - https://www.rapid7.com/blog/post/etr-ivanti-connect-secure-zero-day-exploited-in-the-wild-cve-2026-104935
logsource:
  category: process_creation
  product: linux
detection:
  selection_perl:
    Image|endswith: '/perl'
  selection_bash:
    Image|endswith: '/bash'
    ParentImage|endswith: '/perl'
  selection_python:
    Image|endswith: '/python'
    ParentImage|endswith: '/bash'
  condition: selection_perl and selection_bash and selection_python
fields:

  - Image
  - ParentImage
  - CommandLine
falsepositives:

  - Legitimate administrative scripts on the appliance that chain Perl, Bash and Python. Tune against known maintenance jobs.
level: high

CVE assessment

1 referenced CVE — 1 actively exploited (CISA KEV)

7. Sources

• The Register, "Ivanti patches Connect Secure zero-day after researchers confirm in-the-wild attacks", https://www.theregister.com/security/2026/10/14/ivanti-patches-connect-secure-zero-day-after-researchers-confirm-in-the-wild-attacks/5303095, 2026-10-14.
• Rapid7, "Ivanti Connect Secure zero-day exploited in the wild (CVE-2026-104935)", https://www.rapid7.com/blog/post/etr-ivanti-connect-secure-zero-day-exploited-in-the-wild-cve-2026-104935, 2026-10-13.
• Volexity, "A Series of Unauthenticated Events: Chained Exploitation of Ivanti Connect Secure Zero-Days", https://www.volexity.com/blog/2026/10/13/a-series-of-unauthenticated-events-chained-exploitation-of-ivanti-connect-secure-zero-days/, 2026-10-13.
• CISA Known Exploited Vulnerabilities, CVE-2026-104935, https://nvd.nist.gov/vuln/detail/CVE-2026-104935.
• SecurityWeek, "Ivanti Zero-Day Chain Gave Attackers Root Access to Fully Patched VPN", https://www.securityweek.com/ivanti-zero-day-chain-gave-attackers-root-access-to-fully-patched-vpn/, 2026-10-14.
• Help Net Security, "Attackers chained three Ivanti zero-days to gain root on fully patched VPN appliances", https://www.helpnetsecurity.com/2026/10/14/ivanti-zero-days-gain-root-patched-vpn-appliances/, 2026-10-14.
• The Hacker News, "CISA Urges Immediate Ivanti Connect Secure Updates as Honeypots Log 105 Exploit Attempts", https://thehackernews.com/2026/10/cisa-urges-immediate-ivanti-connect.html, 2026-10-14.

8. Adverse Trace position

Adverse Trace assesses CVE-2026-104935 as P1 for any EMEA financial services client with an internet-facing Ivanti Connect Secure appliance. The verified reference data puts the CVSS at 8.6 HIGH, records confirmed CISA KEV exploitation added 2026-10-13 with a remediation due date of 2026-10-16, and gives an EPSS of 26%. The attribution to UTA0576 is unconfirmed: the actor has no MITRE ATT&CK profile in our reference data, and the entire exploit-chain reconstruction, the criminal-motive assessment and the LLM claim rest on a single Volexity report. We treat the technical chain as credible but single-sourced, and we do not attribute the activity to a known tracked group. The residual unpatched privilege escalation vulnerability is the item we will watch most closely, because it means a fully patched appliance is not yet a fully remediated one. Adverse Trace will re-issue this advisory when Ivanti publishes the privilege escalation fix or assigns it a CVE, and will update the indicator section if Volexity or Ivanti publish atomic indicators. Clients who cannot confirm the version of every ICS appliance in scope should contact us before the 2026-10-16 KEV due date.

Read the original source →

Published via PulseTrace — Adverse Trace threat intelligence.