Ivanti has shipped emergency fixes for a high-severity zero-day in its Connect Secure (ICS) remote-access appliances after confirming that attackers used the flaw against a limited set of customers. The vulnerability, tracked as CVE-2026-104935 and rated 8.6 on the CVSS scale, allows an unauthenticated remote attacker to execute arbitrary commands - a serious failure for a product designed to sit at the edge of corporate networks and broker secure connections for remote employees.
A Chain Built for Full Control
The flaw does not operate in isolation. Research from Volexity, which identified the exploitation, describes a layered attack chain that moves from unauthenticated access to root-level command execution on the appliance itself. Investigators link the authentication-bypass and remote-code-execution stages to CVE-2026-104935, while a separate privilege-escalation weakness delivered the final step to root. According to Volexity's forensic account, the attacker combined an authentication bypass in request routing with a file-write race condition inside an upload handler, first achieving code execution as the appliance's cgi-server user before escalating further. This kind of staged exploitation is increasingly common against network edge devices, which often run hardened but monolithic software stacks where a single logic flaw in request handling can cascade into total compromise.
What the Attackers Did Once Inside
Volexity traced the activity to early October 2026 on an ICS appliance running version 22.8R2.4 - notably, a build the organization believed was fully patched at the time, underscoring why zero-days are so disruptive to standard patch-management assumptions. The firm attributes the intrusion to an actor it tracks as UTA0576, whose identity remains undetermined. Once established with root privileges, the attacker pursued credentials rather than disruption: searching for domain credentials, Local Administrator Password Solution (LAPS) passwords, and BitLocker recovery keys, alongside Active Directory reconnaissance, password spraying, and packet capture aimed at traffic likely to carry authentication data. Rather than planting a web shell or a persistent backdoor, the operator used the exploit channel itself to issue commands and retrieve results - a method that leaves a thinner trail for defenders to find.
Anti-Forensic Techniques Complicate Detection
Perhaps the most consequential detail in Volexity's findings concerns what the attacker did to cover their tracks. The actor reportedly modified in-memory system state and then restored it, while also removing entries from Ivanti's debug logs and Linux audit logs. Because the technique altered memory rather than leaving lasting file changes, Ivanti's Integrity Checker Tool - the standard mechanism administrators rely on to verify appliance integrity - may not flag the activity. That gap matters: a clean scan result cannot, on its own, be treated as proof that a device was never compromised. Organizations with potential exposure should pursue deeper forensic review, including memory and network traffic analysis, rather than relying solely on built-in integrity checks.
Affected Versions and Recommended Action
Ivanti lists ICS versions 25.1.1.1 and earlier, 25.1.2.2 and earlier, and 22.8R2.4 and earlier as affected. Fixes are available in 25.1.1.2, 25.1.3.0 or later, and 22.8R2.5. Versions 22.7R2.14 and earlier are not affected by this particular flaw, but both the 22.7 and 22.8 code lines are scheduled to reach end of life on January 31, 2027, prompting Ivanti to urge customers to migrate to the 25.1 line rather than treat 22.8 as a long-term destination.
- Apply 25.1.1.2, 25.1.3.0 (or later), or 22.8R2.5 depending on current deployment
- Treat 22.8R2.5 as an interim option only, given the January 2027 end-of-life deadline
- Review Volexity's published indicators and monitor requests to /dana-na/auth/url_default/welcome.cgi
- Watch for X-DSCGI-PATH headers pointing to unexpected scripts or temporary files
- Conduct memory and network forensic review for any appliance with signs of compromise, regardless of Integrity Checker results
The episode reinforces a familiar pattern in enterprise security: remote-access gateways, prized precisely because they bridge external users and internal networks, remain among the most attractive targets for sophisticated intrusions, and patching alone is no longer sufficient without rigorous verification behind it.