CVE-2026-104935 Ivanti Connect Secure exploit chain: all three flaws fixed, but the Integrity Checker misses it

Ivanti has now shipped fixes for all three flaws that attackers chained to take over Ivanti Connect Secure VPN appliances without logging in, and CISA has put the last two on its Known Exploited Vulnerabilities (KEV) list. The chain began with CVE-2026-104935, patched on 13 October 2026, and was completed by CVE-2026-111357 and CVE-2026-118527, patched on 29 October. The catch for defenders is that Ivanti's own Integrity Checker Tool does not detect this chain, so a clean scan does not prove an appliance was not breached.

Key points

• Attackers chained three Connect Secure flaws to run commands as root with no login: CVE-2026-104935 (authentication bypass and remote code execution, CVSS 8.6), CVE-2026-111357 (privilege escalation, CVSS 8.8) and CVE-2026-118527 (file write to a predictable location, CVSS 4.3).
• Volexity says exploitation by a group it tracks as UTA0576 began on 3 October 2026, against an appliance that was fully patched at the time (version 22.8R2.4).
• Fixes: CVE-2026-104935 was fixed on 13 October (22.8R2.5, 25.1.3.0 and 25.1.3.1 are listed as unaffected); the other two were fixed on 29 October (25.1.1.3 and 22.8R2.6 in the table The Stack published).
• CISA added CVE-2026-111357 and CVE-2026-118527 to the KEV catalog on 30 October, with federal due dates of 2 November and 13 November 2026.
• Ivanti's Integrity Checker Tool does not detect the exploit, because it changes library code only in memory and restores the configuration data it alters (Volexity).

What to do

Who is affected. Ivanti Connect Secure (ICS) only, per the version ranges in Ivanti's advisory as reported by Singapore's Cyber Security Agency (CSA) and The Stack:

• CVE-2026-104935: 25.1.1.1 and prior, 25.1.2.2 and prior, and 22.8R2.4 and prior.
• CVE-2026-111357 and CVE-2026-118527: 25.1.1.2 and prior, and 22.8R2.5 and prior.

Update. Move to a release that contains all three fixes. The Stack's table of Ivanti's advisory lists 25.1.1.3 and 22.8R2.6 as the resolved versions for the second pair; a third outlet, Daily CyberSecurity, also lists 25.1.3.1. We could not open Ivanti's advisory page itself (it needs JavaScript), so check the exact build for your release train there before you schedule the change.

Check whether you were hit. Do not rely on the Integrity Checker alone. Volexity recommends forensic investigation, including network and memory forensics, for any appliance that shows signs of compromise such as lateral-movement attempts that start from the VPN device. Indicators from the one incident Volexity investigated, as summarised by The Hacker News:

• Large numbers of requests to /dana-na/auth/url_default/welcome.cgi that carry an X-DSCGI-PATH header whose value does not match the URL path.
• A directory at /data/.icscap/ on the appliance.
• Traffic from IP address 108.165.147[.]64, the host the attacker used in that case.

Volexity says the attacker deleted entries from /home/runtime/dlogs/debuglog and /var/log/audit/audit.log, so gaps in those logs from early October may themselves be a warning sign (our reading, not a Volexity statement).

Assume credentials were exposed if you were compromised. Volexity reports the attacker took the LDAP domain credentials stored on the appliance and searched Active Directory for Local Administrator Password Solution (LAPS) passwords, BitLocker recovery keys and password attributes. Rotating the service account used by the appliance and reviewing what it could read is the logical follow-up; that step is our inference, not a Volexity instruction.

What happened

Volexity says it began investigating on 5 October 2026 after suspicious activity at a customer of its network monitoring service. The root cause was an Ivanti Connect Secure appliance on 22.8R2.4, build 19097, which was fully patched at the time. The attacker, tracked as UTA0576, had been exploiting it since 3 October.

Volexity describes three stages:

1. Authentication bypass. A request to the public login script welcome.cgi names a different, protected script in an X-DSCGI-PATH header. The URL decides whether the request is allowed; the header decides where it goes, so the attacker can reach scripts that should require authentication.
2. Code execution. The wu.cgi upload handler writes a file to /home/runtime/tmp/ using the MD5 hash of the supplied filename, and only afterwards checks whether it is a valid ZIP. By uploading a Perl script named like a ZIP and sending parallel requests, the attacker runs it in the short window before it is deleted. Ivanti tracks stages one and two together as CVE-2026-104935.
3. Privilege escalation. The attacker patches, in memory, the library the web process uses, edits a shared configuration store and makes a root-level maintenance service run attacker-controlled Perl. Afterwards the exploit restores the library and configuration to their original state and removes log entries. This is the flaw Ivanti fixed on 29 October as CVE-2026-111357.

The attacker did not leave a backdoor or web shell. Instead, Volexity says, the whole chain was run again for every command, with results returned in the HTTP responses. The Stack describes this as a deliberate choice to pay the cost of re-exploiting each time in return for leaving no persistent artifact; that is The Stack's reading of the behaviour, not a Volexity finding.

CVE-2026-1113578.8

CVE-2026-1049358.6

CVE-2026-1185274.3

CVSS scores of the three chained Ivanti Connect Secure flaws (CVSS score)

	CVSS score
CVE-2026-111357	8.8
CVE-2026-104935	8.6
CVE-2026-118527	4.3

Source: Singapore CSA (CVE-2026-104935); The Stack (the other two)

Background

Ivanti disclosed CVE-2026-104935 and patched it on 13 October, the day Volexity published. Volexity's post says Ivanti had a fix for the privilege-escalation bug in development but not ready. Ivanti said, as quoted by The Stack, that when exploitation was found, a fix for CVE-2026-104935 was already in QA and it chose to ship that first so that customers could close the primary path. The Hacker News reported on 13 October that two of the three flaws had fixes and the third was pending, and that neither Volexity nor Ivanti named a workaround for customers who could not upgrade. Singapore's CSA warned on 20 October that attackers were exploiting CVE-2026-104935 to run arbitrary commands.

On 29 October Ivanti released the remaining fixes. It said it knew of exploitation affecting a limited number of customers when all three flaws were chained, and, as quoted by Daily CyberSecurity, that "a fix is available now for all vulnerabilities which were chained and exploited in the wild." CISA's catalog entry for CVE-2026-111357 describes a local authenticated attacker escalating privileges; the entry for CVE-2026-118527 describes a remote authenticated attacker uploading files with attacker-controlled content to a known location. Both entries note that the flaws can be chained with CVE-2026-104935 and with each other.

Network appliances keep appearing in this list. The Stack counts 26 Ivanti vulnerabilities added to KEV since the start of 2024, six of them this year. We covered other recent edge-device cases in our article on CVE-2026-76418, the Cisco ASA and FTD flaw.

What it means

For VPN administrators, the practical lesson is that patching is necessary but no longer a sufficient answer on an internet-facing gateway. Volexity's finding that the attacked appliance was fully patched when the attack started means the window for the full chain ran from at least 3 October to the 13 October fix, while the privilege-escalation flaw stayed unpatched until 29 October. Any appliance that was reachable on an affected version in that period deserves a forensic look, not just an upgrade.

For security teams that rely on the vendor's integrity tooling, this is a reminder that a tool that checks files on disk cannot see changes made only in memory. Volexity's recommendation is network and memory forensics.

For organisations with Active Directory behind the VPN, the post-exploitation activity matters as much as the exploit. According to Volexity the attacker used the appliance's directory service account to query for LAPS passwords and BitLocker recovery keys, ran a Kerberos testing tool and attempted password spraying. Those secrets would let an intruder move well beyond the VPN.

What we don't know yet

• How many customers were attacked. Neither Volexity nor Ivanti has said; Ivanti says "limited".
• Who UTA0576 is. The Hacker News reports Volexity assessed with low confidence that the motive is criminal rather than espionage.
• Whether upgrading removes access an attacker has already gained. The Hacker News notes neither company's published material addresses it.
• Exact fixed build numbers per release train, which we could not confirm from Ivanti's own page.
• Whether the version tables in the secondary sources match Ivanti's final advisory. Daily CyberSecurity and The Stack list the fixed builds slightly differently.

What to watch next

• Ivanti's advisory for any change to the fixed versions or new indicators.
• CISA's 13 November due date for CVE-2026-118527 and any further KEV additions for Connect Secure.
• Volexity's indicators of compromise, which the company links from its post, and any follow-up on the attacker's tooling.

Sources

• Volexity: A Series of Unauthenticated Events, chained exploitation of Ivanti Connect Secure zero-days (updated 29 October 2026)
• Ivanti: Security Advisory, Ivanti Connect Secure CVE-2026-104935 (not opened by us)
• CISA Known Exploited Vulnerabilities catalog (JSON feed)
• The Stack: Ivanti patches two more CVEs amid highly unusual Connect Secure exploitation
• The Hacker News: Attacker chains three Ivanti Connect Secure zero-days for root access
• Cyber Security Agency of Singapore: Active exploitation of vulnerability in Ivanti Connect Secure
• Daily CyberSecurity: Ivanti Connect Secure vulnerability exploited in the wild