Attackers chain three Ivanti Connect Secure flaws to gain root on fully patched VPN appliances

Volexity reported a threat actor it tracks as UTA0576 chaining three flaws in Ivanti Connect Secure VPN appliances to gain root on a fully patched 22.8R2.4 device in early October. The chain combines an authentication bypass and remote code execution in welcome.cgi, tracked as CVE-2026-104935, a file write in wu.cgi, and a privilege escalation in the dsinvoked broker that trusts DSCache data to run commands as root. Ivanti patched the authentication bypass in its July 25.1.3.0 release and is backporting it, while a fix for the privilege escalation is still in progress. CISA added CVE-2026-104935 to its Known Exploited Vulnerabilities catalog.

Check

Upgrade Ivanti Connect Secure to a fixed release, run Volexity's indicators of compromise, and perform forensic triage, since the Integrity Checker Tool may miss this chain.

Affected

Ivanti Connect Secure appliances, including fully patched 22.8R2.4, can be chained to root by an attacker, and exploitation has been confirmed since early October.

Fix

Apply Ivanti's patches, follow its recovery steps, hunt with Volexity's indicators, and treat exposed appliances as potentially compromised given the Integrity Checker Tool's blind spot.