Ivanti Connect Secure has another exploited zero-day, and this one leaves no web shell for you to find.

Ivanti shipped fixes on Oct 13 for CVE-2026-104935, an authentication bypass in Connect Secure that a remote attacker with no account can use to run commands on the appliance. Ivanti says it knows of exploitation against a limited number of customers. CISA added it to the Known Exploited Vulnerabilities catalog the same day, with a federal due date of Oct 16 (CISA KEV).

The patch is the easy part. The harder part is that the box you are patching may already be lying to you.

What Volexity found. Volexity was investigating suspicious activity at a monitoring customer on Oct 5 and traced it back to a Connect Secure VPN that was fully patched at the time, version 22.8R2.4 Build 19097. The actor, which Volexity tracks as UTA0576, had been exploiting it since Oct 3 with a three-bug chain that ends in unauthenticated root code execution (Volexity).

• An auth bypass. A request goes to the public login script /dana-na/auth/url_default/welcome.cgi, but an X-DSCGI-PATH header points to a protected CGI. The URL decides whether the request is allowed. The header decides where it actually goes.
• A file-write race in wu.cgi. The upload handler writes the file to /home/runtime/tmp/<MD5(filename)> before it checks that the file is a real ZIP. The attacker uploads a Perl script and fires parallel requests at that path before it gets deleted.
• A root escalation through the dsinvoked broker. The actor patches libdsplibs.so in memory, points a DSCache maintenance task at the Perl interpreter, runs it as root, and then puts everything back.

Ivanti tracks the bypass and the RCE under CVE-2026-104935. The privilege escalation is still unpatched. Volexity says Ivanti plans to fix it in a release in the coming weeks (Volexity).

Why the Integrity Checker won't save you. UTA0576 deployed no web shell and no backdoor. It re-ran the whole chain for every command and pulled results back through the HTTPS response. It patched library code only in memory, restored the DSCache entry, and trimmed its own lines out of /home/runtime/dlogs/debuglog and /var/log/audit/audit.log. Volexity says Ivanti's Integrity Checker Tool does not detect it, and you need memory and network forensics to confirm a compromise (Volexity).

What they went after. The actor went after the directory. It pulled the LDAP service-account credentials stored on the VPN and used them to query Active Directory for LAPS local admin passwords, BitLocker recovery keys and password-bearing attributes. It ran Kerberos tooling built for Kerberoasting and password spraying, and it sniffed plaintext LDAP, HTTP Basic and NTLM traffic with a renamed tcpdump in a hidden /data/.icscap/ folder (Volexity). Volexity rates criminal rather than espionage motive as low confidence. It also says, with medium confidence, that the actor used LLMs for exploit development and post-exploitation (Volexity).

Who is exposed. Affected versions are Connect Secure 22.8R2.4 and earlier, 25.1.1.1 and earlier, and 25.1.2.2 and earlier. Fixed builds are 22.8R2.5, 25.1.1.2, and 25.1.3.0 or 25.1.3.1. Ivanti says 22.7R2.14 and earlier are not affected (SecurityOnline, citing Ivanti). Shadowserver tracks more than 5,500 internet-exposed instances (BleepingComputer). Victim count is undisclosed.

What we'd do this morning.

• Patch to a fixed build today, not in the next window. KEV gives federal agencies three days for a reason.
• Hunt your WAF, load balancer or proxy logs for spikes of requests to welcome.cgi carrying an X-DSCGI-PATH header, especially .../dana/fb/smb/wu.cgi or /home/runtime/tmp/. Alert on any request where the URL path and that header don't match (Volexity).
• Look for leftovers in /tmp/, such as JSON dumps, sp_out.txt or spray_hits.json, and for a dsstatmond process or .icscap directory (Volexity).
• If the box looks touched, assume the directory is in scope too. Rotate the ICS LDAP service account, rotate LAPS passwords and BitLocker recovery keys that service account could read, and check the domain controllers for LDAP queries from the VPN's IP.
• Until the privilege-escalation fix ships, treat the appliance as a box that can't vouch for itself. Watch it from outside, at the network layer.

The read. This is the third straight year of Connect Secure zero-days. CISA has now flagged dozens of Ivanti bugs as exploited since 2021 (BleepingComputer). The new part is the tradecraft: no implant, nothing written to disk, and the device's own self-check comes back clean. For buyers weighing a VPN replacement, that matters more than the CVSS score, because an edge box that can't prove it's clean is a liability on the next renewal.