Ivanti Connect Secure zero-day chain: the lesson for WireGuard

News brief, 18 October 2026. Original report: Cybernews, 16 October 2026.

Attackers chained three zero-day vulnerabilities in Ivanti Connect Secure (ICS), the SSL VPN appliance many companies put in front of their network, to get unauthenticated root code execution on devices that were fully patched. Cybernews reported on 16 October that CISA is telling defenders to patch now, and that one of the three flaws still has no fix.

What happened

• From 3 October 2026, a previously unknown actor tracked as UTA0576 exploited the chain in the wild, according to Volexity, which found it on an appliance running 22.8R2.4, the latest version at the time.
• The chain combines an authentication bypass, a remote code execution and a privilege escalation. The first two are tracked as CVE-2026-104935.
• 13 October: Ivanti warns customers and CISA adds CVE-2026-104935 to its Known Exploited Vulnerabilities catalog, with a remediation deadline of 16 October for US federal agencies.
• Ivanti says it had found part of the bug through its own testing and fixed it in the July release 25.1.3.0, but was still backporting the fix to other supported versions when exploitation began.
• Volexity saw the attacker go after Active Directory credentials, LAPS passwords and BitLocker recovery keys. No web shell was left behind: the actor re-exploited the device for every command and tampered with logs.

If you run Ivanti Connect Secure

1. Apply Ivanti's update now. Versions listed as affected in the reporting: 25.1.1.1 and prior, 25.1.2.2 and prior, 22.8R2.4 and prior.
2. Do not rely on the Integrity Checker Tool alone. Volexity explains that the exploit modifies code in memory only, so the on-disk check stays green. CISA asks for network and memory forensics.
3. Search your logs for requests to /dana-na/auth/url_default/welcome.cgi that carry an X-DSCGI-PATH header. That header is the trick behind the bypass: the URL is a public login page, the header points to a script that should never be reachable without a session. watchTowr's Yordan Ganchev told Cybernews he expects the attacks to move "incredibly quickly" to mass exploitation.
4. Assume credentials touched by the appliance are exposed if you find a hit: AD accounts, LAPS, BitLocker keys. Rotate them.

Why SSL VPN appliances keep landing on this list

Ganchev notes this is not the first time: Ivanti Connect Secure and its predecessor Pulse Connect Secure already had 14 other entries in the CISA catalog. The common thread is structural. An SSL VPN appliance runs a web server that answers anyone on the internet before they log in: a login page, CGI scripts, header parsing, session logic. Every one of those lines of code is reachable by an attacker who has no account. The CVE-2026-104935 bypass is a textbook example: one part of the code trusted the URL, another trusted a header.

What a WireGuard port does differently

A WireGuard server has no login page. Its UDP port only reacts to a handshake initiation that is computed with the server's public key. Anything else, including a scanner, a malformed packet or an HTTP request, is dropped without a reply. A scanner sees a port that never answers, the same as one dropped by a firewall, which is why checking that your WireGuard port is reachable has to be done with a real client handshake rather than a port scanner. The attack surface reachable without a key is a fixed-size cryptographic message, not a web application.

That is a real difference, but it is not magic. Be honest about what it leaves to you:

• The host still needs patching. A WireGuard server on a VPS is only as safe as its SSH, its kernel and whatever else you expose. Keep the rest of the box closed.
• Keys are the identity. A stolen private key lets someone impersonate a peer. The MikroTik key exposure case shows that the risk moves to wherever keys are stored.
• No users, no MFA, no SSO. Plain WireGuard knows public keys, not people. For a team that needs per-user access and single sign-on, a control plane such as Headscale or NetBird adds that layer on top of WireGuard.
• It is not a drop-in replacement for a 500-seat deployment with posture checks. For a small team, a homelab or a few admins who need into a network, it often is enough.

A small, auditable alternative

If you are a small team weighing whether to keep a web-facing VPN appliance, the self-hosted route is a VPS with a public IPv4, one UDP port and a config you can read in full. Our free WireGuard config generator writes matching server and client files in your browser, and the Contabo + WireGuard step-by-step guide covers the server side.

Sources

• Cybernews, Stefanie Schappert, Ivanti's three-headed zero-day exploited in the wild: CISA says patch now, but one flaw has no fix, 16 October 2026.
• Volexity, A Series of Unauthenticated Events: Chained Exploitation of Ivanti Connect Secure Zero-Days, 13 October 2026.
• CISA, Known Exploited Vulnerabilities catalog, entry CVE-2026-104935 added 13 October 2026.