CVE-2026-104935: Ivanti VPN auth bypass chain reached root on fully patched appliances

An attack chain against Ivanti Connect Secure VPN appliances turned a single spoofed, unauthenticated request into root-level access on a build that was fully patched at the time, and the final link in that chain still has no fix. According to a Netics Labs write-up on dev.to, drawing on Volexity's incident report, exploitation began on 3 October 2026 against an appliance running 22.8R2.4, and Ivanti published patches on 13 October alongside Volexity's disclosure.

How the chain works

Connect Secure sits at the network edge, terminates employee remote-access tunnels and authenticates users against the corporate directory. The first link abuses how the appliance routes requests from its front-end processes to CGI handlers: a request aimed at the public login script can carry an X-DSCGI-PATH header naming a different script as the real destination. The URL decides whether the request is allowed, while the header decides where it lands, so an unauthenticated request can reach a script that assumes a trusted caller.

The second link converts that reach into a file write. The upload handler hashes the client-supplied filename, writes the content to a path derived from that hash, and only afterwards checks whether the payload is a valid archive. A Perl script given a .zip name fails the check and is queued for deletion, but in the short interval before removal a parallel request can execute it. Volexity describes the payload running as the CGI server user and holding a Python stage entirely in memory.

Ivanti tracked the first two links under a single CVE, CVE-2026-104935, scored 8.6 on the CVSS scale.

Root through a maintenance service

The chain finishes with a privilege escalation that has no CVE and no published patch. A privileged background service called dsinvoked performs maintenance tasks as root and looks up the program for each task in DSCache, a shared configuration store. The exploit patches the CGI server's in-memory copy of an Ivanti library so that store can be edited, reconfigures an existing maintenance task to launch the Perl interpreter, and asks the service to run it. Ivanti has promised a fix in a future release; until it arrives, patching closes the entry point but leaves the escalation available to any attacker who already has code execution on the appliance.

What was taken

Root on a remote-access appliance hands over the credentials the device needs in order to query the directory. The research describes a custom LDAP tool searching the domain for Windows LAPS local-administrator passwords, BitLocker recovery keys, userPassword and unixUserPassword attributes and logon script paths, with results written to temporary storage and exfiltrated over the same HTTPS channel as the commands. A separate Kerberos tool supported Kerberoasting and credential testing, and the packet capture function was aimed at port 389, the LDAP port.

The integrity checker's blind spot

Ivanti's Integrity Checker Tool, which the advisory recommends running, reported a clean file system in this incident. The reason, per the write-up, is that the exploit patches library code in memory and restores the configuration store to its pre-exploitation state before leaving, with entries scrubbed from the appliance debug log and the Linux audit log. A clean result therefore describes only the disk, and the CISA entry for this CVE requires forensic triage precisely because a clean result does not rule out compromise.

Fixed builds and deadlines

According to Ivanti's fix table, the resolved versions are 25.1.1.2, 25.1.3.0, 25.1.3.1 and 22.8R2.5. Affected builds are 25.1.1.1 and earlier, 25.1.2.2 and earlier, and 22.8R2.4 and earlier, while the 22.7 line and below are unaffected, so operators should match their build against the table before scheduling a window.

Rapid7's analysis adds a detail that matters for maintenance planning: part of the flaw was found through Ivanti's own product security program and fixed in the July 2026 release of 25.1.3.0, and backports to the remaining supported lines were still in progress when exploitation started. The newest code line was protected while conservative operators on maintenance branches were not. Rapid7 advises organisations on affected versions to apply the update on an emergency basis, outside normal patching cycles, and to check for prior exploitation.

The federal clock is tighter. CISA added the CVE to its Known Exploited Vulnerabilities catalogue on 13 October with a 16 October remediation deadline for federal civilian agencies, under BOD 26-04.

Why it matters

This incident is a useful corrective to the assumption that a patched appliance is a safe one. The target was current on its patches, part of the flaw had already been fixed upstream months earlier, and the backport gap left supported maintenance branches exposed. The privilege escalation at the end of the chain remains open, which means patching reduces but does not eliminate risk, and defenders have to assume the finish is reachable if anything else grants code execution. The integrity checker's blind spot compounds this: a tool designed to reassure operators reported nothing on a compromised box. Finally, the credentials at stake, directory service accounts, LAPS passwords and BitLocker keys, extend the blast radius well beyond the appliance itself. Ivanti's own October 2026 patch round-up lists exploited edge-appliance flaws in Citrix NetScaler and FortiMail in the same month, a reminder that VPN and edge devices remain a preferred entry point.