CVE-2026-104935: Ivanti Connect Secure Zero-Day Exploited on Patched Appliances

Ivanti warned customers on October 13, 2026 that CVE-2026-104935, a flaw in its Connect Secure (ICS) VPN appliances, is being exploited in the wild. It is an authentication bypass that lets a remote attacker with no credentials run arbitrary commands. CISA added it to the Known Exploited Vulnerabilities (KEV) catalog the same day, with a due date of October 16.

What sets this one apart comes from Volexity, which found the activity while investigating an incident at a customer. A previously unknown actor it tracks as UTA0576 chained three zero-days to get unauthenticated, root-level code execution on a fully patched appliance. Two of the three share this CVE, and the third, a privilege escalation, has no fix yet.

How the Three-Flaw Chain Works

Volexity's write-up describes three steps. The first two are covered by CVE-2026-104935, and the third has no CVE.

1. Authentication bypass. The public welcome.cgi path accepts an X-DSCGI-PATH header that routes the request to protected CGI scripts without a login.
2. Code execution through a race. The wu.cgi upload handler writes a file to disk before it checks that it is a valid ZIP, then deletes it if it is not. The attacker uploads a Perl script disguised as a ZIP and fires parallel requests to run it before deletion.
3. Privilege escalation. The root-level dsinvoked service trusts the DSCache configuration, which lets the attacker's script run commands as root. Ivanti is still working on this fix.

The attacker worked from memory. A Python stage runs in memory, patches the in-memory copy of a system library, runs its command as root, and then restores the state. Volexity found no backdoor or web shell, and the actor re-ran the chain for each command.

After getting in, UTA0576 stole domain credentials stored on the appliance and copied limited Active Directory metadata. A custom tool searched Active Directory for LAPS local admin passwords and BitLocker recovery keys. The actor also ran a Kerberos credential-testing tool, captured LDAP traffic to harvest plaintext credentials and NTLM hashes, sprayed passwords, and truncated log files.

Volexity says the operation was detected and disrupted before the actor's goals became clear. It believes with high confidence the activity prepared the ground for lateral movement. It assesses with low confidence that the motive is criminal rather than espionage, and with medium confidence that the actor used large language models for exploit development and post-exploitation work.

Who Is Affected

Ivanti lists ICS 25.1.1.1 and earlier, 25.1.2.2 and earlier, and 22.8R2.4 and earlier as affected. The fixed releases are 25.1.1.2, 25.1.3.0, 25.1.3.1, and 22.8R2.5. The 22.7 branch and lower do not contain the vulnerability.

Upgrade paths differ by hardware and branch. ISA6000 and ISA8000 appliances on 25.1.1.1 move to 25.1.1.2. Appliances on 22.8 should go to 25.1.1.2 or later, or install 22.8R2.5 if migration cannot happen right away. Moving to 25.1.3.0 requires an ISA4500, ISA6500, or ISA8500 platform, and physical deployments need new servers while virtual and cloud deployments need newly built devices. Both 22.7 and 22.8 reach end of life on January 31, 2027.

Ivanti says a limited number of customers were exploited, and Volexity has confirmed one victim. Volexity dates its earliest evidence to October 3, and the firm Defused reported first signs on October 1. Shadowserver tracks more than 5,500 internet-exposed ICS instances, though it is unclear how many are honeypots or already protected.

A Fix Existed, but Not for Every Branch

Ivanti told CyberScoop that its own team found part of the defect in June, and that it did not meet the threshold for an out-of-band release. The fix was scheduled for the normal release cycle. Rapid7 reports the fix shipped in version 25.1.3.0 in July, while the other supported branches were still waiting on backports. Exploitation started in early October, and those branches received their fixes on October 13, roughly three months after the first one.

The lesson for defenders is narrow and practical. "Fully patched" meant the latest release on a given branch, and a fix sitting in a newer branch protected only the customers who had moved to it. Volexity observed the chain working on 22.8R2.4, the latest 22.8 build at the time.

The severity score adds a second note. Ivanti rates the flaw 8.6, High, for an unauthenticated route to command execution, so a queue that escalates only Critical scores would not flag it on the number alone.

CyberScoop adds the wider record: CISA has listed 36 Ivanti defects in KEV since late 2021, and at least six of them have been exploited since late January. For anyone running ICS, an Ivanti entry in KEV is a pattern to plan for.

Reading It on VulnTracker

The Actively Exploited banner shows KEV status with the two dates that matter: added October 13, 2026, remediation due October 16, 2026. Ransomware use is listed as unknown.

The CVSS panel carries Ivanti's 3.1 score of 8.6, with a network attack vector, low complexity, no privileges, and no user interaction. Confidentiality impact is High and integrity and availability are Low. The weakness is CWE-290, authentication bypass by spoofing, and the status reads Analyzed.

SSVC marks the flaw Active, Automatable, and Total impact. That combination reads as the top of the patch queue: exploitation is happening, it needs no user, and the technical impact is complete. Affected Platforms lists ICS 25.1.0.0 up to but not including 25.1.1.2, ICS 25.1.2.0 up to but not including 25.1.3.0, and the 22.8 line with five affected builds, so check your appliance build against those ranges.

What to Do This Week

The federal due date is October 16, and exploitation began at least two weeks earlier, so treat any internet-facing ICS appliance as a possible compromise until you have checked.

• Upgrade to a fixed release: 25.1.1.2, 25.1.3.0, 25.1.3.1, or 22.8R2.5. Plan the move to the 25.1 line before the 22.x end of life on January 31, 2027.
• Do not rely on the Ivanti Integrity Checker Tool alone. The chain patches memory only and restores its changes, and Volexity says the tool did not detect the modifications. Ivanti advises regular runs, and CISA warns the tool may miss in-memory activity, so add memory and network forensics if you suspect exposure.
• Search web logs for high volumes of requests to /dana-na/auth/url_default/welcome.cgi that carry an X-DSCGI-PATH header, especially where the header path differs from the URL path.
• Check /tmp on the appliance for files such as ml.py, rq5.py, mk.py, rr.py, h.py, sp_run.py, sp_out.txt, spray_hits.json, and pu.txt, and look for a process running from a hidden .icscap directory.
• Treat the appliance's Active Directory service account, LDAP bind credentials, and any account that signed in through the appliance as exposed if you find signs of activity. Review who read LAPS and BitLocker attributes, and watch for lateral movement from the appliance.
• Load Volexity's published indicators from its threat-intel repository on GitHub, and watch Ivanti's advisory for the privilege escalation fix expected in the coming weeks.

Attackers reached root on a VPN appliance that was fully patched by the calendar, because the fix only became available to every branch on October 13. Upgrade first, then hunt, because a clean integrity check cannot clear an appliance on its own. Press Track CVE on VulnTracker to follow CVE-2026-104935 and get alerted when Ivanti ships the fix for the third flaw.

References

Vendor: Ivanti advisory for CVE-2026-104935. NVD: CVE-2026-104935. Analysis: Volexity, SecurityWeek, Cybersecurity News, CyberScoop, BleepingComputer, iTnews.