https://reddit.com/r/sysadmin/comments/1x5ly84/ivanti_connect_secure_zeroday_chain_cve2026104935/: Ivanti Connect Secure zero-day chain (CVE-2026-104935) got root on a fully patched 22.8R2.4 VPN from October 3, and Ivanti had fixed part of it on one branch in July
Affected Software
Frequently Asked Questions
Does exploitation require valid VPN credentials or prior access?
No. The reported entry point is welcome.cgi, the public login page, and the chain was described as unauthenticated.
Were systems that were fully patched at the time still exposed?
Yes. Volexity observed exploitation beginning October 3 against an appliance running 22.8R2.4, described as the fully patched build at that time.
What level of access can an attacker obtain through the reported chain?
The chain uses a race condition in the wu.cgi upload handler for code execution, followed by a flaw in the dsinvoked service to obtain root access.
What update information is available for the 22.8 release line?
Ivanti's patch covers the first two issues in the chain; for the 22.8 line, the cited fixed version is 22.8R2.5. The provided information does not state whether that update addresses the dsinvoked privilege-escalation issue.
How urgent is remediation for organizations subject to CISA requirements?
CISA added CVE-2026-104935 to the Known Exploited Vulnerabilities catalog on October 13. Federal agencies were given until October 16 to address it.