Attackers Chained Three Ivanti Zero-Days and One Is Still Unfixed

The US Cybersecurity and Infrastructure Security Agency added CVE-2026-104935, an authentication bypass in the Ivanti Connect Secure VPN gateway, to its Known Exploited Vulnerabilities catalogue on 13 October 2026. The catalogue entry sets a remediation deadline of 16 October for federal civilian agencies, classifies the weakness as CWE-290, and carries a forensic triage requirement under Binding Operational Directive 26-04. Three days is among the shortest windows CISA issues.

The reason for the compression is in the research CISA points to. Volexity, which reported the flaws to Ivanti, published an account on the same day describing an attacker chaining three separate zero-days. CVE-2026-104935 bundles the first two, an authentication bypass and a remote code execution flaw, which together let an unauthenticated attacker run code as the appliance's cgi-server user. A third flaw, a privilege escalation, raises that to root. Volexity says Ivanti has fixed the first two and that a fix for the third will arrive in a future release in the coming weeks.

A fully patched appliance was not a safe one

Volexity found the intrusion on one customer's gateway. That appliance was running version 22.8R2.4 and was fully patched at the time. The attacker, which Volexity tracks as UTA0576, began exploiting it on 3 October 2026, ten days before any public disclosure. CISA lists versions 25.1.1.1 and prior, 25.1.2.2 and prior, and 22.8R2.4 and prior as affected. Ivanti's security advisory says the company is aware of exploitation in the wild affecting a limited number of customers at the time of disclosure, and neither company has said how many were hit.

Ivanti says it found part of the vulnerability through its own product security programme and fixed that portion in its July 2026 release, version 25.1.3.0, then worked to backport the fix to other supported versions. Customers who had already moved to 25.1.3.0 sit outside the affected range. Customers who had not were exposed to a fix that existed but had not reached them.

The integrity checker will not find it

That line matters more than the CVSS score. The exploit alters library code only in memory and restores the configuration data it changes, according to Volexity, and the attacker took further steps to stay hidden from the tool. CISA says organisations seeking to determine whether they were compromised will need network and memory forensics. The indicators Volexity published come from a single investigation: repeated requests to /dana-na/auth/url_default/welcome.cgi carrying an X-DSCGI-PATH header whose value does not match the URL path, a /data/.icscap/ directory, and the address 108.165.147.64.

The behaviour on the compromised appliance was quiet by design. The attacker stole stored credentials including LDAP domain credentials, searched Active Directory for passwords, and ran password-spraying attacks against the accounts it found. It left no backdoor and no web shell, and re-ran the entire exploit chain for each command it wanted to execute. Volexity assesses with low confidence that the motive is criminal rather than espionage. CISA's recovery guidance assumes the worst: back up the configuration, factory reset, upgrade, restore, then reset every domain, administrator and local account password and revoke and reissue stored certificates and API keys.

The honest reading is that the 16 October deadline buys less than it appears to. Patching closes the front door, but neither Volexity nor Ivanti has said whether upgrading removes access an attacker already holds, and neither has named a workaround for organisations that cannot upgrade in time. As Parallax Nexus has reported, this is the third edge security appliance since late September to reach the catalogue with a forensic triage requirement attached, after Citrix NetScaler and Cisco Catalyst SD-WAN Manager. Ivanti Connect Secure version 22.8 reaches end of life on 31 January 2027.