Ivanti Connect Secure Zero‑Days: CVE‑2026‑104935 and 111357

Ivanti Connect Secure Exploit Chain: From welcome.cgi to Root #

Volexity traced the attacks to a threat actor it tracks as UTA0576, which exploited an appliance running 22.8R2.4, Build 19097, then the newest release, repeatedly from October 3, 2026. The chain combines three flaws: an authentication bypass, a remote code execution in a file upload handler and a privilege escalation. CVE-2026-104935 covers the authentication bypass and the code execution; the privilege escalation to root is CVE-2026-111357, whose record describes how the dsinvoked broker trusts DSCache configuration data.

The entry point is /dana-na/auth/url_default/welcome.cgi, the public script that serves the login page and therefore needs no authentication. The attacker's request names a different script in an X-DSCGI-PATH header, such as the protected upload handler /home/webserver/htdocs/dana/fb/smb/wu.cgi. The appliance decides from the URL whether a request is allowed, but routes it by the header path, so the protected script runs for an unauthenticated caller.

Inside wu.cgi, the upload handler writes the client's file to /home/runtime/tmp/<MD5(filename)> and only afterwards checks whether it is a valid ZIP. UTA0576 uploaded a Perl script with a .zip extension and, in parallel, sent requests whose X-DSCGI-PATH header pointed at that temporary path. When one of them reached the file before the handler deleted it, the script ran in the context of the cgi-server user.

The last step needs root. The dsinvoked service runs maintenance tasks as root and looks up each task's program in DSCache, a shared configuration store. The exploit patched the in-memory copy of /home/lib/libdsplibs.so in the cgi-server process, pointed a maintenance task at the Perl interpreter, had dsinvoked run a malicious script as root and then restored both the DSCache entry and the library. Volexity found no web shell or backdoor: every command re-ran the whole chain and returned its result in the HTTP response.

CVE-2026-111357 and CVE-2026-118527: The Range CISA Revised on October 30 #

Ivanti fixed the authentication bypass and the code execution in patches released on October 13, 2026, while the privilege escalation stayed open; Volexity's later note on its post says Ivanti published the patch for CVE-2026-111357 on October 29, 2026. On October 30, CISA added CVE-2026-111357 and CVE-2026-118527 to its Known Exploited Vulnerabilities catalog, where CVE-2026-104935 had been since October 13, and revised the affected versions. Volexity's October 13 list stopped at 22.8R2.4; the revised range reaches 22.8R2.5, so an appliance on that build is still inside it.

CVE-2026-118527 is a separate weakness in the same appliance. Its record describes predictable file names that let a remote, authenticated attacker upload files with attacker-controlled content to a known location on disk, in Ivanti Connect Secure before 25.1.1.3 and 22.8R2.6. It carries CWE-340 and a MEDIUM rating, and its record was published on November 3, after CISA had already listed it as exploited. The CVE-2026-111357 record names 22.8R2.4 as the affected version and states that the flaw was exploited in the wild in October 2026.

The 22.8 line has a deadline of its own: CISA notes that Ivanti Connect Secure 22.8 reaches end of life on January 31, 2027, and points to Ivanti's 25.x Upgrade and Migration Compatibility Guide for hardware and virtual appliances. For the 22.7 line, the CVE-2026-104935 record states that version 22.7R2.14 and prior are not impacted by that flaw. The same record words its range as "before version 25.1.3.0" without naming a build for each 25.1 line, so Ivanti's advisory is where to confirm the exact target build for yours.

What UTA0576 Took From Ivanti Connect Secure Appliances #

The attacks aimed past the appliance at the directory behind it. UTA0576 extracted credentials stored on the appliance, such as domain credentials used with LDAP, and used the appliance's own Active Directory service account with a custom LDAP tool. It searched for LAPS local administrator passwords, BitLocker recovery keys and the userPassword and unixUserPassword attributes, and wrote the results to compressed JSON files in /tmp/ before taking them out through the exploit channel.

Two more routes to credentials ran on the appliance itself. A renamed tcpdump, /data/.icscap/dsstatmond, captured traffic on ports used by plaintext protocols such as LDAP, HTTP, FTP and telnet, and a script, /data/.icscap/h.py, parsed the captures for LDAP credentials, HTTP Basic credentials and NTLM challenge-response hashes. A Kerberos tool tested credentials, and a password-spraying script tried Active Directory accounts; Volexity read these steps as preparation for lateral movement into the victim's network.

The cleanup explains why a quick check finds nothing. The payload removed recent entries from /home/runtime/dlogs/debuglog and /var/log/audit/audit.log and deleted its scripts and result files. CISA warns that Ivanti's Integrity Checker Tool may not detect exploitation of CVE-2026-104935 because the commands run in memory, and both sources call for network and memory forensics on any appliance that may have been reached.

Patching and Recovering Ivanti Connect Secure Appliances #

CISA's recovery steps do not stop at the appliance: after the factory reset and the upgrade, they reset passwords, certificates and keys. The resets cover every account, including domain accounts, which matches what UTA0576 searched the directory for and captured on the wire. The first two steps apply to every affected appliance; the rest apply where compromise is suspected.

1. Update every appliance to the latest release in Ivanti's security advisory. On the 25.1.1 and 22.8 lines, CISA's range ends at 25.1.1.2 and 22.8R2.5, and the CVE-2026-118527 record names 25.1.1.3 and 22.8R2.6 as the first releases outside its own range.
2. Read Ivanti's 25.x Upgrade and Migration Compatibility Guide before the update, for hardware and virtual appliances, and plan the move off 22.8 before its end of life on January 31, 2027.
3. If compromise is suspected, first create a backup of the appliance configuration, as Ivanti's guide on backing up and restoring the binary configuration with an archiving server describes.
4. Run a factory reset and upgrade the appliance to the latest version; for cloud and virtual systems, rebuild the virtual instance and upgrade it.
5. Restore the appliance configuration from the backup made in step 3.
6. Reset the passwords of all accounts, including domain, administrator and local accounts; the Active Directory service account the appliance uses is the one UTA0576 queried the directory with.
7. Revoke and reissue stored certificates, and reset stored API keys and license server credentials.

Checking Ivanti Connect Secure Logs and Disk for This Chain #

Because the appliance's own logs were edited, the network records of requests that reached the VPN matter as much as the appliance. Volexity's detection starts with the request pattern, and it advises watching for a mismatch between the URL path and the X-DSCGI-PATH header, since threat actors are likely to find other paths to use as the URL or the header target.

• Large numbers of requests for /dana-na/auth/url_default/welcome.cgi that carry X-DSCGI-PATH: /home/webserver/htdocs/dana/fb/smb/wu.cgi or X-DSCGI-PATH: /home/runtime/tmp/<MD5(filename)>.
• Files in /tmp/ left by the post-exploitation steps: ml.py, rq5.py, mk.py, rr.py, pu.txt, sp_out.txt and spray_hits.json, keeping in mind that the attacker deleted some of them.
• The hidden directory /data/.icscap/ with dsstatmond, h.py and rotating capture files named cap0 and up.
• Temporary files named /home/runtime/tmp/ics-root-run-inband-*.pl and /home/runtime/tmp/ics-root-result-inband-*.
• Connections to 108.165.147[.]64, a VPS that Volexity saw running an OpenVPN server from September 30 to October 7, 2026.

The tampering removes only the entries inside the attack's time window from /home/runtime/dlogs/debuglog and /var/log/audit/audit.log and keeps the older ones. Volexity publishes further indicators on its GitHub page, and CISA recommends its write-up for the details of the chain.