Date: October 13, 2026
Author: Threat Research & Intelligence Team, Digital Spying
Category: Enterprise Security / Zero-Day Exploitation / Network Perimeters / VPN Gateways / Threat Intelligence
Tags: Ivanti, Ivanti Connect Secure, ICS, CVE-2026-104935, Volexity, Zero-Day, Authentication Bypass, Command Injection, Root Takeover, CISA KEV
Executive Summary
Enterprise edge infrastructure has once again been thrust into the epicenter of state-sponsored cyber espionage. On October 13, 2026, cybersecurity threat intelligence firm Volexity published a landmark investigative report titled "A Series of Unauthenticated Events: Chained Exploitation of Ivanti Connect Secure Zero-Days", revealing active in-the-wild exploitation of a chained sequence of three zero-day vulnerabilities targeting Ivanti Connect Secure (ICS) VPN appliances.
As detailed by The Hacker News, Cybersecurity News, and an urgent operational directive from the U.S. Cybersecurity and Infrastructure Security Agency (CISA), the threat actors chained an unauthenticated authentication bypass, a secondary Server-Side Request Forgery (SSRF) / arbitrary file access flaw, and a command injection vulnerability. Tracked under CVE-2026-104935, the exploit chain grants remote, unauthenticated attackers arbitrary code execution with complete root privileges.
Telemetry from compromised enterprise appliances revealed that threat actors bypassed Ivanti's on-box Integrity Checker Tool (ICT), dumped plaintext Active Directory credentials and session tokens from internal SQLite databases and system memory, and established persistent web shells. Most alarming for systems administrators: only two of the three chained vulnerabilities have received official software patches so far, leaving unmitigated appliances exposed to ongoing exploitation.
Technical Deep-Dive: Deconstructing the Three-Stage Zero-Day Exploit Chain
To understand how adversaries compromised the perimeter, we dissect the architecture of Ivanti Connect Secure, the three-stage exploitation sequence, and the post-compromise evasion techniques.
Unauthenticated Remote Attacker
Ivanti Connect Secure Web Dispatcher
Underlying Appliance OS (Root Context)
1. Dispatches Crafted HTTP RequestTargets unauthenticated endpoint with manipulated URI routing & custom headers
2. Stage 1: Authentication BypassDispatcher circumvents session check; caller is granted internal auth context
3. Stage 2: SSRF & Internal AccessAccesses internal management APIs and reads local configuration vaults
4. Stage 3: Root Command InjectionDelivers payload via unvalidated parameter and invokes system shell as root
CVE-2026-104935 payload executed
5. Interactive Root Reverse Shell Established
6. Post-Exploitation Harvesting & Evasion• Patches on-box Integrity Checker Tool (ICT) script to hide file modifications• Queries SQLite session databases to extract domain credentials & Kerberos tickets• Deploys persistent web shell into /home/webserver/htdocs/
1. The Component: Ivanti Connect Secure Architecture
Ivanti Connect Secure (formerly Pulse Secure Pulse Connect Secure) is an SSL-VPN appliance utilized by government agencies, defense contractors, and Fortune 500 enterprises to provide secure remote access:
* Web Dispatcher Stack: ICS runs a specialized Linux-based operating system where client requests are terminated by an NGINX front-end and dispatched to backend FastCGI, Python, and Perl daemons handling authentication and session management.
* The Attack Surface: Because the appliance must accept incoming VPN connections from remote employees on the public internet, its web-facing authentication endpoints are universally exposed on port 443.
2. Step-by-Step Chaining: From Unauthenticated Request to Root
The threat actor constructed a multi-stage exploit chain that executed in a single automated interaction:
* Stage 1 (Authentication Bypass): The attacker identified an endpoint within the web management API that failed to enforce authentication interceptor checks when requests contained specific URI path normalizations or header configurations. This tricked the gateway into treating an external unauthenticated HTTP request as if it originated from a trusted internal daemon.
* Stage 2 (SSRF and Parameter Traversal): With authentication bypassed, the attacker accessed restricted administrative microservices. The second vulnerability allowed arbitrary internal API requests to be routed to local service daemons, leaking internal configuration data and session encryption keys.
* Stage 3 (Command Injection - CVE-2026-104935): The final stage delivered an operating system command injection payload into an unvalidated system diagnostic handler. Because the backend service executed commands with root privileges without sanitizing shell metacharacters (|, ;, &), the injected payload executed directly as root.
3. Defense Evasion: Neutralizing the Integrity Checker Tool (ICT)
To maintain persistent access without alerting administrators, the attackers executed sophisticated anti-forensic techniques:
* Tampering with the ICT Scanner: Ivanti provides an internal Integrity Checker Tool (ICT) that scans appliance filesystems against manifest hashes to detect unauthorized modifications. The threat actors modified the local Python and Bash scripts governing the ICT scanner (/home/bin/scanner), creating whitelist rules that excluded their injected webshells and modified libraries from scan reports.
* In-Memory Credential Dumping: Operating with root permissions, the attackers ran memory extraction scripts against active processes (dssetup, dsauth), harvesting plaintext passwords, MFA session cookies, and Active Directory Kerberos tickets belonging to logging-in enterprise users.
* Lightweight Web Shells: The actors deposited custom web shells disguised as legitimate administrative asset files in /home/webserver/htdocs/, enabling continued interactive access even if underlying network sessions were terminated.
Industry Impact on Perimeter Defense and Zero-Trust
The disclosure of CVE-2026-104935 highlights systemic challenges in edge device security:
* Edge Devices as Prime Targets: Threat actors have systematically shifted their primary ingress focus to edge appliances (VPNs, firewalls, ADC controllers) because they lack traditional Endpoint Detection and Response (EDR) sensors.
* The Partial Patch Dilemma: With only two of the three zero-day vulnerabilities officially patched by Ivanti at the time of disclosure, organizations relying solely on binary patches remain partially exposed. Compensating architectural controls are mandatory.
Defensive Hardening Blueprint & Remediation Strategies
Enterprise defenders and network administrators must execute the following emergency procedures immediately:
1. Apply Ivanti Patches & Emergency Mitigations
* Apply the latest security updates released by Ivanti for Connect Secure, Policy Secure, and ZTA gateways.
* Where full firmware updates cannot be deployed immediately, apply Ivanti's provided XML mitigation file to block access to vulnerable web API endpoints.
2. Execute External (Offline) Integrity Checking
Do not trust the on-box ICT tool, as it can be subverted by root-level implants:
* Download the External Integrity Checker Tool directly from Ivanti's portal onto a clean, independent management workstation.
* Take an encrypted configuration snapshot, reboot the appliance into maintenance mode, and execute the external ICT verification process to ensure filesystem hashes match official factory manifests.
3. Mandatory Credential and Secret Revocation
If an appliance is confirmed or suspected to have been compromised:
* Rotate All Active Directory Passwords: Force a domain-wide password reset for all user accounts that authenticated through the VPN appliance during the compromise window.
* Revoke Certificates & API Keys: Immediately revoke and reissue device identity certificates, SAML signing keys, and RADIUS/LDAP service account passwords stored on the device.
4. Perimeter Isolation & Egress Filtering
* Isolate Management Interfaces: Ensure all administrative interfaces are bound exclusively to internal, isolated management VLANs and never exposed to the public internet.
* Enforce Outbound Egress Firewalls: Restrict outbound internet access from the ICS appliance to prevent reverse shell callbacks, data staging, and automated C2 communications.
For real-time perimeter threat intelligence, zero-day exploit breakdowns, and enterprise incident response guides, subscribe to Digital Spying.