Ivanti Connect Secure Zero-Day Chain Grants Root Without Auth on Fully Patched 22.8R2.4 Appliance
An in-the-wild chain of three zero-days in Ivanti Connect Secure allowed root access on a patched appliance. Volexity's single-incident report shows the flaws evade existing detection and that only two have been fixed. CISA rates exploitation as active with total impact.
The exploit began with repeated requests to /dana-na/auth/url_default/welcome.cgi carrying the X-DSCGI-PATH header and writing to /data/.icscap/. Memory-resident library changes and config restoration allowed the chain to evade Ivanti's Integrity Checker Tool. Post-exploitation activity included LDAP credential theft, Active Directory password searches, and password spraying from IP 108.165.147[.]64. No persistent web shells were deployed; the actor re-executed the full chain per command.
Ivanti patched two flaws as CVE-2026-104935 (CVSS 8.6) in versions 25.1.3.0 and 22.8R2.5 while the third privilege-escalation issue remains open. CISA added the CVE with an "active" exploitation flag and "total" technical impact. Release notes for 25.1.3.0 predate the October disclosure, indicating some customers on listed unaffected builds may still be exposed.
The incident reveals a pattern in Ivanti appliances where in-memory-only modifications bypass standard integrity checks, mirroring earlier Connect Secure campaigns that relied on similar stealth. Customers must supplement vendor tooling with network and memory forensics to confirm compromise.
Ivanti plans a fix for the remaining flaw in coming weeks. Until then, organizations should isolate appliances, monitor for the listed indicators, and prepare forensic baselines rather than rely solely on upgrades.
Ivanti: Third privilege-escalation flaw will ship by 15 November 2026; no additional in-wild chains reported against patched 25.1.3.x builds after that date.
Sources (3)
- [1]Volexity Threat Research(https://www.volexity.com/blog/2026/10/13/ivanti-connect-secure-zero-day-chain/)
- [2]The Hacker News(https://thehackernews.com/2026/10/attacker-chains-three-ivanti-connect.html)
- [3]Ivanti Security Advisory(https://www.ivanti.com/support/security-advisories)