Ivanti

The Patched Box

A fully patched Ivanti Connect Secure appliance got hit by a zero-day chain that ran entirely in memory and left no trace the vendor's own integrity tool could find.

Glenn Fryklund

Glenn Fryklund

— 3 min read
Share
The Patched Box
A photorealistic rendering of a rack-mounted network appliance in a dark server room, one red status LED lit among dim others. Rendered with AI.

On October 3rd, an attacker reached into an Ivanti Connect Secure appliance running the latest 22.8R2.4 release and ran commands without authenticating. Ten days later, CISA confirmed active exploitation and added CVE-2026-104935 to the Known Exploited Vulnerabilities catalog. The box was patched. The exploit did not care.

The vulnerability is an authentication bypass by spoofing in ICS versions before 25.1.3.0. A remote, unauthenticated attacker can execute arbitrary commands. NVD scores it CVSS 3.1 base 8.6, HIGH. The affected boundaries are 25.1.1.1 and prior, 25.1.2.2 and prior, and 22.8R2.4 and prior; ICS 22.7R2.14 or prior is not impacted.

Volexity's forensic report, published the same day as the disclosure, names the actor UTA0576 and walks the chain. The first stage is an authentication bypass in the welcome.cgi endpoint, where the X-DSCGI-PATH header routes a request to a protected CGI that should be unreachable without credentials. The second stage is a file-write and race-condition remote code execution in wu.cgi: the actor uploads a Perl script that runs before the system deletes it. The third stage is privilege escalation through the dsinvoked broker, which trusts its own DSCache configuration, and ends with root execution.

What makes this chain distinctive is that it is in-memory only. There is no web shell and no backdoor left on disk. The actor also deleted debug and audit log entries, which is anti-forensics aimed at exactly the kind of check a defender would reach for first.

The post-exploitation activity is credential harvesting at scale. The actor exfiltrated Active Directory credentials and metadata, harvested LAPS passwords and BitLocker recovery keys, captured LDAP traffic, ran Kerberoasting tooling, sprayed passwords, and performed appliance configuration reconnaissance. The RCE and authentication bypass components are tracked under CVE-2026-104935; the privilege escalation fix is still pending in a future release and has no fixed version assigned yet.

The timeline is tight. Exploitation began on October 3rd. Disclosure, the KEV addition, and the patch release all landed on October 13th. CISA set a federal remediation due date of October 16th and required forensic triage.

The defensive takeaway is the part that should change how you investigate. Because the chain runs in memory and restores the configuration store, the Ivanti Integrity Checker Tool may not detect the exploitation. CISA says so directly. The standard disk-based integrity check is the wrong instrument here. You need network and memory forensics to find what the integrity tool will not.

Patch to 25.1.3.0 is the primary control. The follow-up work is the network and memory forensics that the disk-based tool cannot do.

Sources

  • CISA KEV catalog (feed row, dateAdded 2026-10-13, dueDate 2026-10-16, forensicTriage Yes): https://www.cisa.gov/known-exploited-vulnerabilities-catalog
  • CISA alert "CISA Adds Two Known Exploited Vulnerabilities to Catalog" (published 2026-10-13): https://www.cisa.gov/news-events/alerts/2026-10-13/cisa-adds-two-known-exploited-vulnerabilities-catalog
  • CISA alert "CISA Urges Patching Newly Exploited Vulnerability in Ivanti Connect Secure" (published 2026-10-13): https://www.cisa.gov/news-events/alerts/2026-10-13/cisa-urges-patching-newly-exploited-vulnerability-ivanti-connect-secure
  • NVD record CVE-2026-104935 (published 2026-10-13, modified 2026-10-13): https://nvd.nist.gov/vuln/detail/CVE-2026-104935
  • Volexity "A Series of Unauthenticated Events: Chained Exploitation of Ivanti Connect Secure Zero-Days" (published 2026-10-13): https://www.volexity.com/blog/2026-10-13/a-series-of-unauthenticated-events-chained-exploitation-of-ivanti-connect-secure-zero-days/
This article was drafted with AI/LLM assistance and reviewed by a human before publication. All factual claims were checked against the public sources cited above. The feature image was generated with AI. See How we use AI for the full workflow.
Topics:

Read more