Ivanti's three-headed zero-day exploited in wild, CISA says patch now – but one flaw has no fix
Security researchers tell Cybernews the threat could quickly escalate to mass exploitation.
Image by Cybernews.
Follow us
- Attackers chained three Ivanti Connect Secure zero-days to gain root-level control of fully patched devices.
- CISA urges organizations to patch and run network and memory forensics for signs of exploitation.
- Ivanti has fixed CVE-2026-104935, but a related privilege escalation flaw still has no patch.
- Researchers warn attacks could spread from targeted intrusions to broader exploitation.
Key Takeaways by nexos.ai, reviewed by Cybernews staff.
For nearly two weeks, three Ivanti Connect Secure VPN zero-day vulnerabilities have been actively exploited in the wild. Now, CISA is urging defenders to patch immediately – problem is, Ivanti says one of the flaws has no fix yet.
Ivanti began alerting customers about the zero-days affecting its Connect Secure VPN devices on October 13th, nearly two weeks after the IT and security solutions company became aware of the exploit chain and almost three months after discovering an initial portion of the vulnerability chain.
“Beginning October 3, a previously unknown threat actor, UTA0576, chained three vulnerabilities to gain unauthenticated root-level code execution on a fully patched device,” said Volexity, whose researchers first discovered the exploit chain.
.@Volexity has discovered in-the-wild exploitation of a #zeroday exploit chain targeting Ivanti Connect Secure VPN appliances (CVE-2026-104935). Beginning October 3, a previously unknown threat actor, UTA0576, chained three vulnerabilities to gain unauthenticated root-level code execution on a fully patched device. Notably, UTA0576 deployed no malware or web shell. Instead, the threat actor re-exploited the device for every command it ran and tampered with logs to cover its tracks, evading Ivanti’s Integrity Checker Tool. Using its #Volcano memory analysis platform, Volexity analyzed the compromised device’s memory to uncover the full exploit chain and the attacker’s post-exploitation activity, which focused on credential theft, Active Directory reconnaissance, and data exfiltration. Volexity reported these findings to Ivanti through coordinated disclosure. Read the full analysis, including detection guidance and IOCs, in our blog post here: https://t.co/y9tzKqbaKe #DFIR #threatintel #memoryforensics
undefined Volexity (@Volexity) October 13, 2026
The cybersecurity company also noted that the threat actor was able to exploit its victims without deploying any malware or web shell.
Instead, the threat actor re-exploited the device for every command it ran and tampered with logs to cover its tracks, evading Ivanti’s Integrity Checker Tool,security researchers at Volexity said.
Ivanti found part of zero-day in July
According to an Ivanti security advisory on the authentication bypass vulnerability as of 8:00 p.m. Tuesday, only a limited number of customers had suffered exploitation.
Describing it as a "high severity vulnerability," Ivanti says successful exploitation of CVE-2026-104935 "could allow a remote unauthenticated attacker to execute arbitrary commands," with the third stage of the exploit chain being a privilege escalation vulnerability.
Ultimately, CVE-2026-104935 can enable credential theft and data exfiltration.
🚨 We added Ivanti Connect Secure vulnerability CVE-2026-104935 to the KEV Catalog after observed exploitation. A remote attacker could bypass authentication to execute commands, steal credentials, and exfiltrate data. Update now and review our Alert. 🔗 https://t.co/2PVRlm2P4B https://t.co/7jHAwbBfyz
undefined CISA Cyber (@CISACyber) October 14, 2026
The advisory also reveals that Ivanti “initially discovered a portion of this vulnerability as part of our product security program and patched it in the July release 25.1.3.0.”
We had been working to backport the fix to the remaining supported versions when exploitation occurred,Ivanti states in the October 13th security advisory.
CISA, which added CVE-2026-104935 to its Known Exploited Vulnerabilities (KEV) Catalog, says the affected versions of Ivanti Connect Secure appliances include:
- 25.1.1.1 and prior
- 25.1.2.2 and prior
- 22.8R2.4 and prior.
More importantly, CISA is also urging organizations to “conduct network and memory forensics to identify evidence of exploitation” – reiterating Volexity’s warning that because the attackers' commands are executed in memory, Ivanti's Integrity Checker Tool may not detect the activity.
Third Ivanti zero-day still has no fix
While Ivanti has released updates addressing CVE-2026-104935, the third zero-day in the exploit chain – a privilege escalation vulnerability – still has no fix.
And with attackers already exploiting the chain in the wild, researchers warn organizations could soon face much broader attacks.
Ivanti Connect Secure has long been a popular target for attackers, including ransomware gangs.Yordan Ganchev, principal threat intelligence specialist at watchTowr, told Cybernews.
Given the history, we expect exploitation to move incredibly quickly from targeted attacks to indiscriminate mass exploitation.
Ganchev also describes the root cause of CVE-2026-104935 as "incredibly simple," saying a single request containing a specially crafted "X-DSCGI-PATH" header is all that's needed to bypass authentication and access sensitive functionality that should otherwise be restricted.
Check if your data was exposed
Find out if your email and related personal information have appeared in known data breaches.
"Organizations running Ivanti Connect Secure should patch immediately and investigate their appliances for signs of compromise, including identifying any inbound requests featuring a 'X-DSCGI-PATH" header,' Ganchev said.
Ganchev also points out that this flaw joins 14 other Ivanti Connect Secure and Pulse Connect Secure vulnerabilities on the CISA KEV list.
