In a concerning development, attackers are exploiting zero-day vulnerabilities in Ivanti Connect Secure VPN devices, allowing them to gain unauthorized root access and potentially compromise sensitive data. Security firm Volexity has been actively monitoring these intrusions, which have affected a select number of Ivanti customers.
Security Breach and Immediate Measures
Ivanti has acknowledged the assaults on specific clients and issued new security patches on October 29, 2026, following prior updates released earlier in the month. These patches aim to mitigate the exploitation of these vulnerabilities.
Volexity’s investigation, which began on October 5, revealed that even fully patched Ivanti appliances running version 22.8R2.4 (Build 19097) were susceptible to these flaws. This indicates that the exploits can bypass existing defense mechanisms, highlighting the severity of the issue.
Details of the Exploitation Method
The attack initiates with an authentication bypass via the public login script, welcome.cgi. A discrepancy between the requested URL and the X-DSCGI-PATH header grants the attacker access to a protected upload handler without authentication.
The wu.cgi upload handler then writes data to a temporary location before verifying it as a valid ZIP file. Attackers exploited this by uploading and executing a Perl script before the system could delete it, achieving code execution.
Further Exploitation and Recommendations
The attackers manipulated the dsinvoked service by modifying library code in memory and altering tasks within the DSCache configuration. This allowed them to execute code as root, subsequently restoring original settings to avoid detection.
Ivanti tracks multiple vulnerabilities, including CVE-2026-104935 for authentication bypass and CVE-2026-111357 for privilege escalation. Notably, these exploits did not involve installing persistent backdoors, instead opting for repeated exploit chains for command execution.
After gaining access, attackers extracted domain credentials and leveraged the VPN appliance’s Active Directory account to probe internal systems, targeting sensitive data like Windows LAPS passwords and BitLocker keys.
Conclusion and Future Outlook
Ivanti’s recent updates, versions 25.1.1.3 and 22.8R2.6, are designed to address all known vulnerabilities. Administrators are advised to consult Ivanti’s guidance to determine the appropriate upgrades.
Security teams are encouraged to scrutinize unusual traffic patterns, particularly concerning welcome.cgi, and monitor for mismatched request paths. Comprehensive memory, disk, and network analysis is crucial, as attackers may have altered logs to obscure their activities.
