Ivanti Zero-Day CVE-2026-104935: 3 Bugs Give Root [2026]

The US Cybersecurity and Infrastructure Security Agency added a new Ivanti Connect Secure vulnerability to its Known Exploited Vulnerabilities catalog on October 14, 2026, after researchers confirmed that attackers had found a way to get root-level access on VPN appliances that were already fully patched. The flaw, tracked as CVE-2026-104935, is not a single bug. It is the final link in a three-vulnerability chain that lets an unauthenticated attacker walk straight past login screens and into the operating system underneath. Federal civilian agencies now have until October 16, 2026, to apply mitigations or lose network access to their own appliances, and security teams at banks, hospitals, and manufacturers are racing to catch up before criminal and state-linked groups finish scanning the internet for exposed boxes.

The ivanti connect secure zero day story matters well beyond one vendor’s patch cycle. Connect Secure appliances sit at the edge of thousands of corporate networks, authenticating remote employees and contractors before letting them touch anything internal. A flaw that grants root there is a flaw that hands an attacker the keys to everything behind it. Security research firm Volexity says the attacks began weeks before the public ever heard about them, and honeypot sensors had already logged 105 exploit attempts by October 15, 2026, a sign that the window between disclosure and mass scanning has nearly closed shut.

Google · Preferred Sources

Don't miss new tech stories on Google

Add TrendinTech once in the Google app and our stories appear in your news suggestions.

Add Now

What CVE-2026-104935 Actually Does

CVE-2026-104935 is described as an authentication-bypass vulnerability affecting Ivanti Connect Secure, the company’s enterprise VPN appliance used to broker remote access into corporate networks. The flaw lets a remote, unauthenticated attacker execute arbitrary commands on the device, and it carries a reported CVSS score of 8.6, a rating that places it firmly in the high-severity band reserved for bugs that require no credentials and no user interaction to exploit. CISA confirmed that threat actors were actively exploiting the flaw before the agency added it to its Known Exploited Vulnerabilities catalog, which is the federal government’s running list of bugs it has verified are being used in real attacks rather than sitting as theoretical risk in a lab report.

What separates this ivanti connect secure zero day from a routine patch-Tuesday bug is that CVE-2026-104935 is not exploited alone. It is the capstone of a three-bug chain, and understanding the chain matters more than memorizing a single CVE number, because the individual pieces touch different parts of the appliance’s software stack.

Inside the Three-Bug Exploit Chain

According to reporting on the incident, the attack chain strings together an authentication bypass in the appliance’s welcome.cgi component, a file-write flaw in wu.cgi, and a privilege-escalation issue involving the dsinvoked broker process and its DSCache configuration data. Chained in sequence, those three weaknesses take an attacker from an anonymous network connection to full root-level code execution, even on appliances that administrators believed were fully patched against earlier Ivanti disclosures.

Exploit chain observed against Ivanti Connect Secure (per incident reporting):
1. Authentication bypass via welcome.cgi (no credentials required)
2. File-write vulnerability via wu.cgi (plants attacker-controlled data)
3. Privilege escalation through the dsinvoked broker and DSCache config
Result: unauthenticated root-level code execution on a patched appliance

That last point is the one keeping chief information security officers up at night. Patch compliance has always been the baseline defense against appliance-level attacks, and a chain that reaches root on a box that already received its vendor updates breaks the assumption that “patched” means “safe.” Reported exploitation of the chain enabled credential theft and data exfiltration, meaning victims were not just losing control of the appliance itself but losing the usernames, passwords, and session data that the VPN was supposed to be protecting on the way into the rest of the network.

Who Is Behind the Attacks

Volexity, the security research company that first documented the chain, said a previously unknown threat actor it has designated UTA0576 began exploiting the three vulnerabilities on October 3, 2026, to gain unauthenticated root-level code execution on a fully patched device. Volexity described the activity directly: “Beginning October 3, a previously unknown threat actor, UTA0576, chained three vulnerabilities to gain unauthenticated root-level code execution on a fully patched device,” as reported by Cybernews. The UTA naming convention Volexity uses is typically reserved for clusters of activity the firm has not yet linked to a known criminal group or nation-state operation, which means defenders are currently tracking behavior and infrastructure rather than a named adversary with an established playbook.

That lack of attribution is itself a data point. It suggests either a new group testing capability against a high-value target class, or an established actor deliberately using fresh infrastructure to avoid tripping detections built around known indicators. Either reading points to the same practical conclusion for network defenders: treat any Connect Secure appliance that has not received the October 14 patch as potentially compromised rather than merely vulnerable, since the exploitation window opened roughly eleven days before the public disclosure.

CISA’s Emergency Directive and the October 16 Deadline

CISA’s decision to add CVE-2026-104935 to its Known Exploited Vulnerabilities catalog triggers Binding Operational Directive requirements for federal civilian executive branch agencies, which now must apply mitigations or the vendor fix by October 16, 2026. That is an unusually tight window even by CISA’s standards, and it signals how seriously the agency is treating active root-level exploitation of a device sitting at the network perimeter. Private-sector organizations are not bound by the directive’s legal deadline, but security teams typically treat KEV additions as a de facto industry deadline anyway, since the listing confirms real-world exploitation rather than a theoretical proof of concept.

Organizations that already run a disciplined vulnerability-triage process built around the KEV catalog are better positioned to move fast here. TrendinTech has previously walked through how to wire Nuclei scanning directly into CISA’s KEV feed so that a new catalog addition like CVE-2026-104935 automatically flags exposed assets instead of waiting for a manual spreadsheet review.

Which Ivanti Connect Secure Versions Are Affected

Reported affected versions span multiple release branches rather than a single build. Ivanti Connect Secure 25.1.1.1 and earlier is named in the advisory, alongside version 25.1.2.2 and earlier, and the older 22.8R2.4 and earlier release line is also included among affected versions. The spread across both a current branch and a legacy branch suggests the underlying weaknesses in welcome.cgi, wu.cgi, and the dsinvoked broker have existed in the codebase for some time, rather than being introduced by a single recent update.

Version Branch	Status	Notes
22.8R2.4 and earlier	Affected	Legacy release line named in the advisory
25.1.1.1 and earlier	Affected	Primary branch cited in the CISA listing
25.1.2.2 and earlier	Affected	Most recent branch named as vulnerable
Fully patched pre-October 14 builds	Affected per Volexity	UTA0576 reached root despite prior patch level
Post-October 14 patched builds	Remediated per Ivanti	Vendor says the unauthenticated RCE component is closed

Ivanti’s Response and Patch Timeline

Ivanti has pushed back on the idea that it sat on a known bug. A company spokesperson told CyberScoop that “because the issue was discovered internally, was not being actively exploited, and did not meet the threshold for an out-of-band release, a fix was scheduled for inclusion in our normal product release cycle.” That explains why a vulnerability now sitting in CISA’s exploited-in-the-wild catalog was initially slated for a routine update rather than an emergency patch, a decision the company is now revisiting in public.

The same Ivanti spokesperson described the fix itself to CyberScoop: “Successful exploitation requires chaining multiple vulnerabilities and Ivanti has fully addressed the unauthenticated remote code execution component of that chain, eliminating the primary exploitation path.” In a separate statement, the company told Help Net Security that “we had been working to backport the fix to the remaining supported versions when exploitation occurred,” suggesting the patch rollout across older branches like 22.8R2.4 was already underway, just not yet complete, when UTA0576 moved first. Ivanti also acknowledged the exploitation directly to The Register, stating “we are aware of exploitation in the wild affecting a limited number of customers at the time of disclosure.”

Timeline: From First Exploitation to the CISA Listing

Date	Event
Before October 3, 2026	Ivanti says it discovered the issue internally and scheduled it for its normal release cycle
October 3, 2026	Volexity says threat actor UTA0576 begins exploiting the three-bug chain for root access
October 14, 2026	Ivanti ships a fix addressing the unauthenticated remote code execution component
October 14, 2026	CISA adds CVE-2026-104935 to its Known Exploited Vulnerabilities catalog
October 15, 2026	Honeypot monitoring logs 105 exploit attempts against the vulnerability
October 16, 2026	Deadline for US federal civilian agencies to apply mitigations or the fix

The eleven-day gap between UTA0576’s first exploitation and Ivanti’s patch is the span security teams should focus on. Any Connect Secure appliance exposed to the internet during that window, regardless of patch level before October 14, should be treated as a candidate for forensic review rather than assumed safe once the update is applied.

A Pattern of Edge-Device Attacks: Historical Context

Enterprise VPN and remote-access appliances have become one of the most consistently targeted categories of enterprise hardware precisely because of what they are designed to do: sit on the public internet while holding a trusted position inside the network. That combination has made Connect Secure and similar perimeter appliances a repeated focus for both financially motivated and state-linked intrusion groups over the past several years, with each new disclosure reinforcing the same lesson, that authentication on an edge device is only as strong as the code parsing requests before that authentication check ever runs.

The broader pattern extends past VPN gateways. French authorities spent part of this same week investigating a separate cyberattack that knocked out refrigeration systems across hundreds of stores, a reminder that attackers are not limiting themselves to data theft when they get a foothold on internet-facing infrastructure. Credential exposure tied to weak authentication has also been a recurring theme in 2026, following the discovery that a breach in Denmark left 8.8 million accounts exposed partly because of the password “123456” still in active use. The Connect Secure chain is a more technically sophisticated failure than a weak password, but it produces the same outcome for an attacker: a door into the network that the defender believed was locked.

Competitive Comparison: How Vendors Are Handling Disclosure

Ivanti’s public explanation, that the bug was found internally, judged not to be under active exploitation, and queued for a normal release, is the same explanation enterprise security vendors have leaned on for years when a bug slips from “known” to “exploited” before a scheduled patch ships. The gap between that explanation and Volexity’s independent finding that UTA0576 was already active on October 3 is the part of this story competitors and customers alike will scrutinize, because it raises the question of how a vendor’s internal severity assessment missed a chain capable of reaching root.

Compared with the typical response curve for a KEV-listed appliance bug, Ivanti’s eleven-day turnaround from Volexity’s observed first exploitation to a shipped fix sits in the middle of the pack, faster than the multi-week delays that have drawn criticism for other perimeter-device vendors in past incidents, but slower than the same-week emergency patches issued when a vendor treats internal discovery as a worst-case scenario from the outset. The backport work Ivanti described to Help Net Security, covering the 22.8R2.4 legacy branch alongside current releases, also reflects a broader industry problem: security teams running older but still-supported versions are frequently last in line for a fix, even when those versions remain fully exposed to the same exploit chain.

The Same Week, a Different Attack Vector: AdFection

The Ivanti chain is not the only mercenary-grade attack technique to surface this week. The University of Toronto’s Citizen Lab separately reported on zero-click spyware delivered through targeted online advertisements, a technique it has named “AdFection.” Citizen Lab said the attacks could begin the moment an advertisement rendered, without the target clicking a link, opening a message, or taking any other action, and that the technique worked against both iOS and Android devices. Researchers linked the campaign with high confidence to spyware attributed to Candiru, delivered through ads associated with a platform called Discover-Tech, and said Candiru and a second firm, Bindecy, both used that platform. Citizen Lab documented at least 45 devices belonging to Al Jazeera that were targeted during 2024 and 2025, and described the finding as the first public confirmation of zero-click mercenary spyware delivered through targeted ads, as detailed by Ars Technica.

Bill Marczak, a senior researcher at Citizen Lab, put the capability in blunt terms, saying that “AdFection allows operators to automatically hack specific individuals with mercenary spyware as they use apps or browse the internet,” a quote also carried by TechCrunch. Citizen Lab said it remains unclear which governments were behind the attacks. Taken together with the Connect Secure chain, the two stories illustrate how mercenary-grade capability now spans both consumer ad networks and enterprise network appliances, a spread that Wired has described as a widening front for zero-interaction compromise.

Market and Enterprise Impact

The immediate market impact of a KEV-listed root-access chain falls hardest on managed security providers and the enterprises that depend on them to triage urgent patches within hours rather than weeks. Honeypot sensors recording 105 exploit attempts by October 15, 2026, less than 48 hours after the CISA listing, points to automated scanning already underway, the pattern security teams typically see once proof-of-concept exploitation details start circulating among both researchers and criminal groups watching the same public advisories.

Scanning Activity Is Already Climbing

The jump from zero public honeypot hits to 105 within a day and a half of the CISA listing is a familiar curve for anyone who has tracked prior perimeter-appliance disclosures. Opportunistic scanning tends to spike fast once a CVE number and a vendor advisory confirm which exact product and version range to target, well before any public proof-of-concept code circulates. Defenders should expect that number to keep climbing through the rest of October as both researchers and criminal groups refine their scanning signatures against the welcome.cgi and wu.cgi endpoints named in the advisory.

Insurance and Compliance Pressure

For Ivanti specifically, the incident lands at a sensitive moment for a company whose appliances sit in the critical path for remote access at banks, healthcare providers, and government contractors, customers for whom a root-level compromise is not a theoretical risk but a regulatory reporting event. Enterprises that treat edge-device patching as a scheduled maintenance task rather than an emergency response function are the ones most exposed when a chain like this surfaces, and cyber-insurance underwriters have increasingly started asking pointed questions about patch cadence for exactly this class of device during renewal season.

What Security Teams Should Do Now

Apply Ivanti’s October 14 patch to every Connect Secure appliance, prioritizing internet-facing instances first.
Treat any appliance that was internet-facing before October 14 as a candidate for forensic review, not just patching, given Volexity’s October 3 exploitation date.
Rotate credentials and session tokens tied to affected appliances, since reported exploitation enabled credential theft and data exfiltration.
Confirm backported fixes reached legacy branches like 22.8R2.4, since Ivanti said that backport work was still in progress when exploitation occurred.
Feed the CVE-2026-104935 KEV entry into automated vulnerability-scanning pipelines so future catalog additions trigger alerts without manual review.

Teams managing the credentials that sit behind these appliances should also revisit basic password hygiene across the organization. Weak or reused passwords remain one of the fastest ways an initial appliance compromise turns into a full network breach, which is part of why security teams increasingly recommend a self-hosted password manager setup for credentials tied to critical infrastructure rather than relying on browser-stored passwords that travel wherever an employee’s laptop goes.

Law Enforcement and the Broader Cybercrime Picture

The Ivanti disclosure arrives against a backdrop of increased law enforcement activity against the groups that typically monetize exactly this kind of initial network access. The FBI’s recent arrest of a second suspect tied to the ShinyHunters data-theft operation is a reminder that appliance-level compromises like the Connect Secure chain frequently feed directly into the data-brokering and extortion economy those groups run. An unauthenticated root exploit on a VPN gateway is rarely the end goal for an attacker, it is the entry point that makes everything downstream, from credential harvesting to ransomware staging, possible.

Predictions: Where This Story Goes Next

Expect mass scanning for unpatched Connect Secure appliances to climb well past the 105 honeypot attempts logged on October 15, as automated tools incorporating public advisory details reach a wider pool of opportunistic attackers.
Expect additional disclosures tying UTA0576 to a named criminal syndicate or state-linked operation within weeks, once Volexity and other researchers correlate infrastructure across victim networks.
Expect other Ivanti-adjacent enterprise appliance vendors to face renewed scrutiny over internal severity triage processes, given the gap between Ivanti’s “not actively exploited” internal assessment and Volexity’s independent finding.
Expect enterprises running the 22.8R2.4 legacy branch to lag furthest behind on remediation, consistent with the historical pattern of older supported branches receiving backported fixes last.
Expect cyber-insurance carriers to begin asking policyholders directly about Connect Secure patch status during upcoming renewal cycles, mirroring how carriers responded to prior high-profile edge-device incidents.

Why the Welcome.cgi and Wu.cgi Flaws Matter Technically

The technical detail of which specific components carried the chain is worth unpacking for engineering teams responsible for appliance hardening. An authentication bypass in welcome.cgi means the front door itself, the page meant to gate access before login, can be walked past entirely. A file-write flaw in wu.cgi then gives an attacker who is already past that gate a way to drop or modify files on the appliance’s file system, typically the step that plants the payload or configuration change needed for the next stage. The final piece, privilege escalation through the dsinvoked broker and its DSCache configuration data, is what turns a foothold with limited permissions into full root control, the level of access that lets an attacker read every credential the appliance has ever processed and modify the device’s own security controls.

Chains built from three separate low-to-moderate severity components reaching a high-severity outcome are becoming a recognizable pattern across enterprise appliance security research, precisely because vendors tend to score and patch each component in isolation rather than modeling how an attacker might link them together. That gap between component-level and chain-level risk assessment is likely to be the central lesson security researchers draw from this specific ivanti connect secure zero day incident once formal post-mortems are published.

Frequently Asked Questions

What is CVE-2026-104935?
It is an authentication-bypass vulnerability in Ivanti Connect Secure that lets a remote, unauthenticated attacker execute arbitrary commands, carrying a reported CVSS score of 8.6. CISA added it to its Known Exploited Vulnerabilities catalog on October 14, 2026.

Which Ivanti Connect Secure versions are affected?
Reported affected versions include 25.1.1.1 and earlier, 25.1.2.2 and earlier, and the 22.8R2.4 and earlier legacy branch.

How does the exploit chain work?
Reporting describes a three-step chain: an authentication bypass in welcome.cgi, a file-write flaw in wu.cgi, and a privilege-escalation issue involving the dsinvoked broker and DSCache configuration data, together producing unauthenticated root-level code execution.

Who is exploiting this vulnerability?
Security research company Volexity attributed the activity to a previously unknown threat actor it calls UTA0576, which it said began exploiting the chain on October 3, 2026.

What is the deadline for fixing it?
CISA directed US federal civilian agencies to apply mitigations or the fix by October 16, 2026. Private organizations are not legally bound by that date but are widely encouraged to treat KEV listings with the same urgency.

Has Ivanti released a patch?
Yes. Ivanti said it shipped a fix on October 14, 2026, addressing the unauthenticated remote code execution component of the chain, and said it was backporting the fix to remaining supported versions, including the legacy 22.8R2.4 branch.

Is this related to the AdFection zero-click ad spyware story?
No, the two are separate incidents. AdFection, reported by Citizen Lab, is a zero-click spyware technique delivered through targeted online ads and linked to Candiru. The Ivanti Connect Secure chain is a separate network-appliance vulnerability exploited by a different threat actor, UTA0576. Both surfaced the same week and illustrate different mercenary-grade attack vectors.

How many exploit attempts have been recorded?
Honeypot monitoring had logged 105 exploit attempts against the vulnerability by October 15, 2026, suggesting automated scanning is already underway following the public disclosure.

Ivanti Zero-Day Lets Hackers Chain 3 Bugs for Root [2026]