A high-severity flaw in Ivanti Connect Secure, the widely deployed enterprise VPN appliance, is being actively exploited by an unidentified threat actor to break into fully patched systems and seize root-level control. Tracked as CVE-2026-104935 and rated 8.6 on the CVSS scale, the vulnerability allows an unauthenticated attacker to bypass login controls entirely and run arbitrary commands. Ivanti confirmed limited exploitation on October 13, 2026, and the vulnerability has since been added to the Cybersecurity and Infrastructure Security Agency's Known Exploited Vulnerabilities catalog.
How a Routing Quirk Opened the Door
The investigation, carried out by the security firm Volexity, began after a supposedly fully updated Ivanti Connect Secure appliance showed signs of compromise. The attacker, designated UTA0576, exploited a discrepancy in how the appliance validates incoming requests. A publicly reachable endpoint, used for legitimate authentication workflows, checks the request's public-facing URL to decide whether access should be granted - but a separate HTTP header, X-DSCGI-PATH, actually determines which internal script processes the request. That gap let attackers route unauthenticated traffic toward a protected upload handler normally reserved for authenticated sessions.
From there, the attacker uploaded a disguised script and exploited a narrow timing window between file creation and deletion to execute it before the system could clean it up. This gave them code execution as a low-privileged service account - the first link in a longer chain.
From Low-Privilege Access to Root, Without Leaving a Trace
Gaining a foothold was only the beginning. UTA0576 paired the authentication bypass with a second, still-unpatched privilege-escalation flaw affecting an internal maintenance service, manipulating configuration data held only in memory to trick the service into executing attacker-controlled code as root. Crucially, the intrusion was designed to clean up after itself: modified memory states were restored, and entries were stripped from debug and audit logs, leaving minimal traces on disk.
That matters because Ivanti's Integrity Checker Tool, the primary vendor-recommended defense for these appliances, is built to catch unexpected file changes - not memory-resident tampering that self-reverts. Volexity found the technique capable of evading that safeguard, a reminder that file-integrity monitoring alone cannot substitute for patching and network-level detection.
What Attackers Went After Once Inside
Once established with root privileges, the intruders did not install a conventional backdoor. Instead, they re-ran the entire exploitation chain each time they needed to issue a command, returning results through the same encrypted web traffic used for normal appliance operation - a pattern that complicates detection because there is no persistent implant to find.
Their objectives were squarely credential-focused. Investigators observed the attackers harvesting stored credentials from the appliance, querying Active Directory, hunting for Windows LAPS passwords and BitLocker recovery keys, testing accounts through password spraying, and capturing LDAP traffic - all hallmarks of preparation for deeper lateral movement inside a victim's network. Volexity assessed with low confidence that the actor's motivation leans criminal rather than espionage-driven, and separately noted, with medium confidence, indications that large language models may have assisted parts of the exploit development or post-exploitation work.
What Organizations Should Do Now
Ivanti has released fixed versions addressing the authentication bypass and remote-code-execution components, including 22.8R2.5 and multiple builds on the 25.1.x branch, with the vendor urging migration to the newer 25.x line as the 22.x branch nears end of life. The companion privilege-escalation flaw used in the observed attacks remained unpatched at the time of disclosure, which makes closing the initial entry point especially urgent - without it, attackers cannot reach the stage needed to exploit the second flaw.
- Apply the applicable Ivanti Connect Secure update immediately rather than relying on integrity scans alone.
- Monitor for mismatches between request URLs and the X-DSCGI-PATH header, particularly references to the wu.cgi handler or temporary upload directories.
- Treat credentials accessible through the appliance, including LDAP service accounts, as potentially exposed and rotate them after containment.
- Review Active Directory logs for unusual LDAP queries, password spraying, and access to LAPS or BitLocker attributes originating from the VPN appliance.
With a federal remediation deadline already set and public technical detail now available, security teams should assume that other actors may attempt to reproduce the technique. The episode underscores a recurring truth about internet-facing VPN infrastructure: it sits at the perimeter precisely where attackers look first, and even fully patched systems can harbor unknown weaknesses until someone is actively exploiting them.