AN attacker chained three Ivanti Connect Secure zero-days to gain root-level access without logging in, with the exploitation observed in the wild starting on 3 October and disclosure on 13 October 2026. The first two flaws form an authentication bypass and remote code execution that together allow code to run as the appliance’s CGI server user, while the third vulnerability escalates privileges to root.
These flaws are tracked together as CVE-2026-104935, and Ivanti has released fixes for two of the flaws, warning customers on affected versions to act urgently. A fix for the privilege-escalation flaw is still pending, according to security researchers at Volexity.
Ivanti’s CVE record details affected Connect Secure versions as “before version 25.1.3[.]0,” with 22.7R2.14 or earlier noted as not affected, and versions 22.8R2.5, 25.1.3[.]0 and 25.1.3[.]1 listed as unaffected. Ivanti’s advisory provides further guidance on affected versions and the available fixes.
Volexity identified one compromised appliance (fully patched at the time, running 22.8R2.4) and described exploitation signs that can aid forensic confirmation: plentiful requests to the URL path /dana-na/auth/url_default/welcome[.]cgi, an HTTP header X-DSCGI-PATH with a mismatched value, the directory /data/.icscap/, and the attacker IP 108.165.147[.]64. The attacker reportedly stole LDAP domain credentials, conducted password spraying, and repeatedly replayed the exploit chain for each command.
Ivanti notes limited exploitation in the wild, while Volexity cautions that the tool used (Integrity Checker Tool) misses this chain because the memory-only changes and in-memory library modifications are not detected.