Ivanti Connect Secure Zero-Day CVE-2026-104935 Exploited; CISA Sets October 16 Deadline

Ivanti has patched an authentication bypass and a remote code execution flaw in Connect Secure (ICS) VPN appliances, both tracked as CVE-2026-104935, that attackers exploited as a zero-day, including on a fully patched 22.8R2.4 appliance. Ivanti says part of the bug was fixed in 25.1.3.0 in July and it was still backporting the fix to other branches when exploitation began. CISA added the CVE to its Known Exploited Vulnerabilities (KEV) catalog on October 13, 2026 with a due date of October 16. A third flaw in the same attack chain, a root privilege escalation, is still unpatched.

What happened

On October 13, 2026, Ivanti disclosed CVE-2026-104935 and released fixes. It said it was aware of limited exploitation in the wild and urged customers to upgrade and run its Integrity Checker Tool regularly (Ivanti).

Volexity found and reported the flaw. Its researchers began investigating on October 5 after suspicious activity at a customer, and traced it to an ICS appliance running 22.8R2.4, which was fully patched at the time. They say a previously unknown actor, tracked as UTA0576, had been exploiting a zero-day chain there since at least October 3 (Volexity). BleepingComputer reports that Defused saw first signs of exploitation from October 1; we did not read Defused's post (BleepingComputer).

Why it matters

ICS sits at the network edge, holds directory service credentials and gives access to internal systems. Shadowserver tracks more than 5,500 internet-exposed ICS instances, though it is unknown how many are honeypots or already patched (BleepingComputer).

Ivanti rates it 8.6 (CVSS 3.1, High), vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L; NVD has not scored it itself and shows Ivanti's score. The record lists the weakness as CWE-290, authentication bypass by spoofing (NVD). CISA's own SSVC data in the record marks exploitation as active, automatable and technical impact as total.

CISA's KEV entry marks known ransomware use as "Unknown" and states that forensic triage is required under BOD 26-04 (CISA KEV). The required action is to apply vendor mitigations in line with BOD 26-04 and CISA's Forensics Triage Requirements, follow BOD 26-04 guidance for cloud services, or stop using the product if mitigations are not available. The entry adds that stakeholders are responsible for evaluating each asset's internet exposure (see also the recent Citrix NetScaler SAML flaw on KEV).

Technical details

Volexity describes three chained flaws. Ivanti tracks the first two under CVE-2026-104935.

• Authentication bypass. An attacker sends a request to the public login script welcome.cgi with an X-DSCGI-PATH header naming a different, non-public CGI. The URL decides whether the request is allowed, but the header decides where it goes, so protected scripts become reachable without authentication.
• Remote code execution. The wu.cgi upload handler writes a file to disk before it checks that it is a valid ZIP, then deletes it. UTA0576 uploaded a Perl script named as a ZIP and raced parallel requests to execute it before deletion.
• Privilege escalation (unpatched). The attacker alters, in memory only, a library and a configuration store so the privileged dsinvoked service runs attacker-supplied Perl as root, then restores the original state. Volexity says Ivanti is working on a fix that will ship in a future release "in the coming weeks".

The actor deployed no web shell or malware. Each command re-ran the full exploit chain and returned its output in the HTTP response. It also removed entries from the Ivanti debug log and the Linux audit log. Because on-disk files were not changed, Volexity says the Integrity Checker Tool does not detect the compromise, and forensic investigation is required.

Post-exploitation focused on credentials: extracting stored domain credentials, searching Active Directory for LAPS passwords and BitLocker recovery keys, parsing LDAP packet captures made with a renamed tcpdump in /data/.icscap/, Kerberos tooling and password spraying. Volexity assesses with low confidence that the actor is criminal rather than espionage-motivated, and with medium confidence that it used large language models for exploit development and post-exploitation activity. Volexity did not establish the actor's final objective.

Who is exposed, and which build fixes it

Ivanti's advisory table, as reproduced by Rapid7, lists these affected and fixed builds. NVD's product data matches it (25.1.0.0 to before 25.1.1.2, 25.1.2.0 to before 25.1.3.0, and 22.8R2 through R2.4). We could not read the Ivanti page itself, which needs a browser session, so the table rests on Rapid7's copy (Rapid7).

Rapid7 quotes Ivanti as saying a portion of the flaw "was initially discovered through its product security program and patched in the July 2026 release of 25.1.3.0", and that exploitation occurred while Ivanti was working to backport the fix to the remaining supported versions. So 25.1.3.x was already covered; the 25.1.1, 25.1.2 and 22.8R2 lines were not. BleepingComputer also lists 22.8R2.4 and earlier as affected.

What defenders should do

1. Upgrade to the fixed build for your branch (table above). Ivanti's advisory says 22.7.x and below are unaffected.
2. Assume exposure if you were reachable before patching. Patching does not remove an attacker who already used the flaw (we made the same point about the SonicWall SMA1000 zero-days). Per CISA, forensic triage is required for federal agencies; private organisations should do the same.
3. Hunt. Ivanti says reliable indicators of compromise are not available (per Rapid7), so use Volexity's. Look for many requests to /dana-na/auth/url_default/welcome.cgi, especially where the X-DSCGI-PATH header does not match the URL path, and for leftover files in /tmp/. Volexity's indicators and YARA rules are on its GitHub.
4. Capture memory and disk before rebooting a suspect appliance; a clean Integrity Checker result is not evidence of safety.
5. Rotate credentials held by or reachable from the appliance, including the LDAP service account, and check for LAPS and BitLocker data access in Active Directory logs.
6. Reduce exposure of the management and login interfaces until the privilege escalation fix ships.

What is still unclear

• The Ivanti advisory page itself could not be read (it requires a browser session); we rely on Rapid7's copy of its table, which matches NVD.
• The privilege escalation flaw has no fix or CVE identifier in the sources we read.
• Number of victims, and whether ransomware groups use it, are unknown.

ThreatFrontier covered an earlier Ivanti Connect Secure exploited flaw: CISA Adds Actively Exploited Ivanti Connect Secure Flaw CVE-2025-22457 to KEV Catalog.

Sources

• Volexity: A Series of Unauthenticated Events
• Volexity IoCs and YARA
• Ivanti October 2026 Security Update
• CISA KEV entry
• NVD CVE-2026-104935
• Rapid7: Ivanti Connect Secure zero-day exploited in the wild
• BleepingComputer