A patched Ivanti appliance on 22.8R2.4 fell to three zero-days

A fully patched Ivanti Connect Secure appliance, running version 22.8R2.4, was compromised on October 3. Volexity, which investigated the incident and reported the flaws to Ivanti, says an attacker it tracks as UTA0576 chained three zero-days to run commands as root without authenticating. Ivanti shipped fixes for two of the three and told affected customers on October 13 to “act immediately.” The fix for the third is still pending.

The first two flaws share one identifier, CVE-2026-104935: an authentication bypass and a remote code execution bug. Used together they give an attacker code execution as the appliance’s cgi-server user. The third flaw, a privilege escalation, takes that to root. Ivanti rates CVE-2026-104935 at 8.6 on CVSS. CISA’s entry in the CVE record marks exploitation as active and the technical impact as total.

The affected-version list is where this gets awkward for operators. Ivanti’s CVE record says Connect Secure before 25.1.3.0 is affected, and lists 22.8R2.5, 25.1.3.0 and 25.1.3.1 as unaffected. Versions 22.7R2.14 and prior are also not affected. The compromised appliance was on 22.8R2.4, inside the affected range. The release notes for 25.1.3.0 are dated July 2026, so the fixed build has existed for months; anyone already on that version sits outside the range the CVE record gives.

Ivanti’s standard advice is to upgrade and run its Integrity Checker Tool regularly. Volexity says the tool misses this chain. The exploit modifies library code only in memory and restores the configuration data it alters, and the attacker took further steps to hide from the checker. Confirming a compromise needs network and memory forensics, not a clean ICT run.

The tradecraft is worth describing because it shapes what you look for. No web shell or backdoor was left on the appliance. UTA0576 reran the entire three-stage exploit chain for every command it wanted to execute, which leaves no persistent implant on disk for the Integrity Checker Tool to catch. The signatures Volexity pulled from the one incident it investigated are:

• Large numbers of requests to /dana-na/auth/url_default/welcome.cgi
• An X-DSCGI-PATH header on those requests whose value does not match the URL path
• The directory /data/.icscap/
• Traffic involving 108.165.147[.]64, the host the attacker used

Once on the box, the attacker went after credentials. It stole stored credentials including LDAP domain credentials, searched Active Directory for passwords, and ran password-spraying attacks against the accounts it found. Volexity assessed with low confidence that UTA0576 is a criminal actor rather than an espionage one. Neither company said how many customers were hit; Volexity found the activity on a single appliance, and Ivanti described “limited exploitation in the wild.”

The same Ivanti advisory also patches two unrelated products, each rated higher than the Connect Secure chain: CVE-2026-106042 in Xtraction before 2026.4 and CVE-2026-109412 in Neurons Patch for Intune, both 9.9 on CVSS. Ivanti says it is not aware of either being exploited.

Two gaps in the reports matter for your response plan. Neither Volexity nor Ivanti names a temporary workaround for customers who cannot upgrade immediately, and neither says whether upgrading removes access an attacker already has. The appliance held LDAP domain credentials and those were stolen, so treat any confirmed compromise as a domain-credential incident: rotate what was on the box and assume the sprayed accounts were probed.

The privilege-escalation flaw, the third in the chain, is still unpatched; Ivanti says a fix will arrive “in a future release in the coming weeks.” Volexity’s report does not say what that flaw lets an attacker do on an appliance where the first two holes are closed, so whether the two available patches are enough on their own is an open question.