Ivanti Connect Secure CVE-2026-104935 (CVSS 8.6): auth bypass and RCE exploited as a zero-day since at least 3 October, now in CISA KEV; chained with an unpatched privilege escalation for root; upgrade to 22.8R2.5, 25.1.1.2 or 25.1.3.x

Ivanti disclosed CVE-2026-104935 in Ivanti Connect Secure (ICS) on 13 October 2026 and said it is aware of limited exploitation in the wild, urging customers on affected versions to act immediately, upgrade to the fixed release and run the Integrity Checker Tool regularly. The CVE record describes an authentication bypass by spoofing that lets a remote unauthenticated attacker execute arbitrary commands; ICS 22.7R2.14 and earlier are not affected. Volexity, which found and reported the issue, says a previously unknown actor it tracks as UTA0576 exploited a fully patched 22.8R2.4 appliance from 3 October 2026. The chain abused a request-routing bypass in the public welcome.cgi page (an X-DSCGI-PATH header pointing at an internal script), a race in the wu.cgi upload handler to run a briefly written Perl script, and a separate privilege escalation in the dsinvoked broker's trust of DSCache data to reach root. Ivanti tracks the bypass and RCE together as CVE-2026-104935; BleepingComputer reports the privilege escalation is still being fixed. The actor deployed no web shell, re-exploited the device for each command, tampered with debug and audit logs and evaded the Integrity Checker. Post-exploitation targeted Active Directory: LDAP service credentials stored on the appliance, LAPS passwords, BitLocker recovery keys, Kerberoasting and password spraying. Defused reports first exploitation signs from 1 October, and Shadowserver tracks more than 5,500 internet-exposed ICS instances. CISA added CVE-2026-104935 to its Known Exploited Vulnerabilities catalog on 13 October, with a 16 October patch deadline for US federal agencies, and issued an alert saying it is aware of actors using the flaw for credential theft and data exfiltration. CISA warns the Integrity Checker may miss exploitation because commands run in memory, so confirming compromise needs network and memory forensics, and it says Connect Secure 22.8 reaches end of life on 31 January 2027. Rapid7 reports Ivanti had found part of the issue internally and fixed it in 25.1.3.0 in July, and exploitation came while backports to other branches were still under way; iTnews lists 25.1.1.2 among the fixed builds. Volexity assesses with medium confidence that UTA0576 used large language models to build its tooling. On 14 October The Hacker News reported that Previdian honeypot sensors had logged 105 exploitation attempts from 50 unique IPs (mainly Singapore and the US) as of that date, using the X-DSCGI-PATH header to reach an internal CGI handler and upload Perl scripts packaged as ZIP files that return execution-test markers; payloads seen so far were mostly weaponisation probes rather than full malware drops. Sample source IPs published by Previdian include 216.73.160[.]59, 216.73.160[.]61, 216.73.160[.]210 and 45.8.19[.]111.

Product

Ivanti Connect Secure (ICS) SSL VPN appliance

Versions

Affected per CISA: ICS 25.1.1.1 and prior, 25.1.2.2 and prior, 22.8R2.4 and prior (CVE record: before 25.1.3.0). Not affected: 22.7R2.14 and earlier. Fixed: 22.8R2.5, 25.1.1.2, 25.1.3.0, 25.1.3.1. ICS 22.8 is end of life on 31 Jan 2027.

CVSS

8.6 (Ivanti CNA, CVSS 3.1)

Exploited in Australia?

unknown

Patch to

Upgrade ICS now to 22.8R2.5, 25.1.1.2 or 25.1.3.0/25.1.3.1 per the Ivanti advisory, and plan the move off 22.8 before its 31 Jan 2027 end of life. Do not rely on a clean Integrity Checker scan: review VPN-originated LDAP and Kerberos activity and check for requests to /dana-na/auth/url_default/welcome.cgi carrying a mismatched X-DSCGI-PATH header. If you suspect compromise, follow CISA's recovery steps: back up the configuration, factory reset and upgrade (rebuild virtual instances), restore the configuration, then reset all domain, admin and local passwords, revoke and reissue stored certificates, and reset stored API keys and licence server credentials. Watch for Ivanti's fix for the remaining privilege escalation.

Primary: Ivanti — October 2026 Security Update (13 Oct 2026; links the Connect Secure CVE-2026-104935 advisory) · Vendor: Ivanti Security Advisory — Ivanti Connect Secure CVE-2026-104935 · CVE: CVE-2026-104935 · CISA — CISA urges patching newly exploited vulnerability in Ivanti Connect Secure (13 Oct 2026); also Volexity UTA0576 report, BleepingComputer, The Hacker News and iTnews (13–14 Oct); THN/Previdian honeypot: 105 attempts by 14 Oct

vulnerabilities network identity