Ivanti Connect Secure Zero-Day CVE-2026-104935 Exploited Before a Patch

Ivanti has confirmed that its Connect Secure VPN is being exploited before a patch was available. The flaw, tracked as CVE-2026-104935 (CVSS 8.6), lets an attacker bypass authentication and then run commands remotely, with no valid account. According to Volexity, it is chained with a third flaw that is still unpatched to gain root access, even on a fully patched appliance. It has been in CISA’s Known Exploited Vulnerabilities catalog since October 13, 2026.

What is happening?

Volexity describes a chain of three flaws used by an actor it tracks as UTA0576:

• Authentication bypass (CVE-2026-104935, CWE-290): access control relies on the public URL path, while internal routing uses the X-DSCGI-PATH header. The attacker can therefore reach protected CGI scripts.
• Remote code execution (also covered by CVE-2026-104935): the wu.cgi upload handler writes the file to disk before checking that it is a valid ZIP. A race condition lets the attacker run it before it is deleted.
• Privilege escalation (dsinvoked service and DSCache): no CVE so far and no fix, it gives root code execution.

Ivanti says a limited number of customers were affected before disclosure. Volexity found no malware or web shell: the attacker re-exploited the device for each command, tampered with logs and evaded the Integrity Checker Tool. It stole credentials stored on the appliance, searched Active Directory for LAPS passwords and BitLocker keys, attempted password spraying and mapped the network. The operation was detected and disrupted; Volexity assesses with high confidence that it signaled preparation for lateral movement. It has low confidence that the motive is criminal rather than espionage, and medium confidence that the actor uses large language models.

On exposure, Shadowserver tracks more than 5,500 internet-exposed Ivanti Connect Secure instances (some may be honeypots or already protected). That figure measures exposure, not compromise: the number of compromised devices is unknown.

Timeline

• July 2026: version 25.1.3.0 already fixes part of the flaw. Ivanti was backporting that fix to other branches when exploitation began.
• October 3: Volexity observes the start of exploitation (Defused reports first signs as early as October 1).
• October 5: Volexity opens an investigation at one of its customers.
• October 13: Volexity publishes its analysis, Ivanti publishes its advisory and patches, and CISA adds the flaw to its KEV catalog.
• October 16: remediation deadline for US federal agencies.

Affected and fixed versions

According to Ivanti’s advisory, the affected versions are 22.8R2.4 and earlier, 25.1.1.1 and earlier and 25.1.2.2 and earlier. The 22.7.x branches and earlier are not affected. The fixed versions are 22.8R2.5, 25.1.1.2, 25.1.3.0 and 25.1.3.1: 25.1.1.2 for ISA6000 and ISA8000, 25.1.3.0 or 25.1.3.1 for ISA4500, ISA6500 and ISA8500. 22.8R2.5 is an interim step: watchTowr recommends moving straight to 25.1.1.2 or later.

A third flaw, still unpatched

Ivanti fixed the first two flaws in the chain, not the privilege escalation, for which it promises a fix “in the coming weeks”. As of October 19, 2026, none of the sources we reviewed reports its release. Applying the CVE-2026-104935 update is therefore essential but does not close the whole chain: keep monitoring the appliance after updating.

What to do now

• Apply the update urgently, outside the normal patch cycle, to the fixed version for your branch. Ivanti describes no workaround: updating is the only listed remedy.
• Preserve evidence (logs, configuration, images) before changing the appliance.
• Do not rely on the Integrity Checker Tool: Ivanti recommends running it regularly, but Volexity says it did not detect this activity. Network and memory forensics are more reliable.
• Hunt for traces: high request volume to welcome.cgi, mismatches between the requested URL and the X-DSCGI-PATH header (notably wu.cgi), suspicious files in /tmp/, /home/runtime/tmp/ and /data/.icscap/ (for example dsstatmond or h.py).
• Watch the network: appliance traffic toward Active Directory, LDAP and DNS, and the attacker-linked IP 108.165.147[.]64.
• Rotate exposed secrets, including the LDAP service accounts the appliance uses.
• Monitor Active Directory: unusual LDAP queries, password spraying, access to LAPS or BitLocker attributes, Kerberoasting and abnormal Kerberos activity.
• Plan the move to the 25.x series: 22.x is nearing end of life.

Ivanti says it had no reliable indicators of compromise when it published its advisory. Volexity published its own on GitHub: use them as a starting point, not as proof that you are clean.

Why this matters for businesses

An SSL VPN is internet-facing by design and sits at the edge of the internal network. Once compromised, it exposes the credentials passing through it and the company directory. This is the classic case where the patch arrives after the attack: the real question is whether the appliance was already hit, not just whether to update it. The flaw adds to the zero-days covered in our October 2026 Patch Tuesday analysis. To limit the damage from a compromised exposed device, the same isolation logic applies as with Docker sbx sandboxes: segment so an attacker can reach less.

Sources

• Volexity, “A Series of Unauthenticated Events” (October 13, 2026)
• watchTowr, CVE-2026-104935 FAQ (versions from the Ivanti advisory)
• SecurityWeek, Ivanti zero-day chain
• The Register, October 14, 2026
• BleepingComputer (Shadowserver exposure)
• Rapid7, CVE-2026-104935 analysis
• Security Affairs, CISA KEV listing