Is the October 13 fix enough?

It closes the way in, not the whole chain. According to Volexity, CVE-2026-104935 covers the authentication bypass and the file write that lead to code execution; a third flaw, a privilege escalation to root in the dsinvoked service, has no fix yet and is due in a future release. The fix is still urgent: without the way in, the escalation cannot be reached from outside.

Why does the Integrity Checker Tool see nothing?

Because the chain changes library code in memory only and restores the configuration data it alters. CISA writes that Ivanti's tool may not detect exploitation because the attacker's commands execute in memory. A clean result from the tool does not prove there was no compromise.

What to do when in doubt?

CISA recommends network and memory forensics, then, if compromise is suspected, backing up the configuration, factory resetting the appliance and upgrading it. Passwords for every account must change, domain accounts included, stored certificates revoked and reissued, and API keys renewed.

Analysis · Exposure

Ivanti Connect Secure: what the integrity checker misses

Since October 3, 2026, a chain of flaws has given root on Ivanti Connect Secure, in memory. The October 13 fix, a flaw still open, and what to hunt for.

By Sentrix · Published 2026-10-14

On October 13, 2026, Volexity published its analysis of a chain of three flaws exploited against Ivanti Connect Secure VPN gateways since October 3. The same day, Ivanti fixed the way in and CISA added CVE-2026-104935 to its KEV catalog. Two details make the case unusual: Ivanti's own checking tool sees nothing, and one of the three flaws is still open.

What the sources say

Volexity (October 13). The attacker, tracked as UTA0576, repeatedly exploited the flaws from October 3, 2026. The chain combines an authentication bypass in welcome.cgi and a file write through a race condition in wu.cgi, both tracked as CVE-2026-104935, then a privilege escalation to root in the dsinvoked service. Volexity writes that Ivanti's Integrity Checker Tool "does not detect any modifications", because the chain patches code in memory and restores the configuration.

After the intrusion, the attacker extracted stored credentials, including the domain credentials used for LDAP, queried Active Directory for LAPS passwords and BitLocker recovery keys, captured LDAP traffic with a renamed tcpdump, and tried to clean the logs.

CISA (October 13). The agency describes a "zero-day authentication bypass vulnerability" and lists the affected versions: 25.1.1.1 and earlier, 25.1.2.2 and earlier, 22.8R2.4 and earlier. It warns that the integrity tool "may not detect evidence of exploitation of CVE-2026-104935 because threat actor commands execute in memory". It also notes that version 22.8 reaches end of life on January 31, 2027.

The KEV catalog. CVE-2026-104935 has been listed since October 13, with an October 16 due date for US federal agencies.

Why it matters

A VPN gateway is where an organisation places the most trust: it holds domain service accounts, sees authentications pass and opens the internal network. Here the attacker was not after the gateway: it was after the Active Directory behind it.

The second lesson is about proof. Many teams close an Ivanti incident on a green result from the integrity tool. This case shows that a green result is worth nothing when the attack leaves no trace on disk. The only safe response assumes compromise and acts on what the attacker could see: the credentials.

What we think at Sentrix

Patch now, on every gateway, and watch for the fix of the privilege escalation, still pending.
Hunt, do not assume. Volexity says what to look for: a high volume of requests to /dana-na/auth/url_default/welcome.cgi with mismatched X-DSCGI-PATH headers, and traces in /tmp/. Our incident response service takes over if you find something.
Change the credentials the gateway knows: LDAP service accounts, administrators, certificates, API keys. That is CISA's recommendation, and that is where the attacker went.
Plan the exit from the 22.8 branch, end of life on January 31, 2027, with a date in the risk register.
Keep the inventory of edge devices, version by version. It is the base of the continuous exposure (CTEM) module, and the same lesson as NetScaler the week before.

For an MSP or an MSSP, a client's gateway is often bound to its directory by a highly privileged service account. Rotate those passwords at every affected client, and record the rotation client by client.

The next step

List your Ivanti Connect Secure gateways with their version and the date of the fix. For each one, note which domain account it uses and when that password last changed. If you want to run that check with us, contact us.

Sources

Frequently asked questions

Is the October 13 fix enough?: It closes the way in, not the whole chain. According to Volexity, CVE-2026-104935 covers the authentication bypass and the file write that lead to code execution; a third flaw, a privilege escalation to root in the dsinvoked service, has no fix yet and is due in a future release. The fix is still urgent: without the way in, the escalation cannot be reached from outside.
Why does the Integrity Checker Tool see nothing?: Because the chain changes library code in memory only and restores the configuration data it alters. CISA writes that Ivanti's tool may not detect exploitation because the attacker's commands execute in memory. A clean result from the tool does not prove there was no compromise.
What to do when in doubt?: CISA recommends network and memory forensics, then, if compromise is suspected, backing up the configuration, factory resetting the appliance and upgrading it. Passwords for every account must change, domain accounts included, stored certificates revoked and reissued, and API keys renewed.

Let's talk about your compliance program.

Contact us