Follow Ivanti has disclosed CVE-2026-104935, a high-severity vulnerability in Ivanti Connect Secure (ICS) that is being actively exploited in real-world attacks. The flaw carries a CVSS score of 8.6 and enables unauthenticated attackers to bypass authentication and execute arbitrary commands on vulnerable VPN appliances.
The vulnerability came to light after Volexity investigated a compromised Ivanti Connect Secure appliance that was fully patched at the time. The previously unknown threat actor, tracked as UTA0576, chained the authentication bypass and remote code execution covered by CVE-2026-104935 with a separate privilege-escalation zero-day to achieve unauthenticated root-level command execution.
The observed campaign demonstrates the security risks associated with vulnerabilities in internet-facing VPN infrastructure. After gaining root privileges, the attackers targeted credentials, Active Directory data, LAPS passwords, BitLocker recovery keys, and other sensitive information that could support lateral movement deeper into the victim environment.
Ivanti confirmed on October 13, 2026 that it was aware of limited exploitation in the wild and urged organizations running impacted releases to act immediately. CISA subsequently added the vulnerability to its Known Exploited Vulnerabilities catalog.
Security teams can leverage SOC Prime’s AI-Native Detection Intelligence Platform to accelerate investigation of emerging threats and operationalize detection content across SIEM, EDR, XDR, and Data Lake environments.
Prime Architect can further assist detection engineers by transforming emerging threat intelligence into detection logic, hunting queries, and environment-specific rules, while Prime Hunt enables retrospective investigation across organizational telemetry.
CVE-2026-104935 Analysis
CVE-2026-104935 affects specific versions of Ivanti Connect Secure and combines two weaknesses used by attackers to move from an unauthenticated web request to arbitrary code execution in the context of the cgi-server account.
The vulnerability is categorized as an authentication bypass by spoofing under CWE-290. According to Ivanti, the issue can be exploited remotely without credentials or user interaction and has a CVSS score of 8.6.
Volexity reconstructed the exploitation chain while investigating an appliance running Ivanti Connect Secure 22.8R2.4, Build 19097. The device was considered fully patched when malicious activity began on October 3, 2026. Researchers started investigating the incident on October 5 and subsequently worked with Ivanti to analyze memory, disk images, and core dumps from the affected system.
The first stage abuses request-routing behavior associated with the publicly accessible /dana-na/auth/url_default/welcome.cgi endpoint. Attackers can supply an X-DSCGI-PATH HTTP header pointing to a CGI resource that would normally require authentication.
The security decision is based on the public URL while the header controls the actual script receiving the request. This discrepancy allows an attacker to route unauthenticated requests to protected CGI functionality.
UTA0576 used this mechanism to reach wu.cgi, an upload handler containing the second vulnerability. The attacker submitted a malicious Perl script disguised with a .zip extension. The handler temporarily wrote the uploaded content to /home/runtime/tmp/ before checking whether the file was a valid ZIP archive.
Although an invalid file was subsequently deleted, attackers exploited the short period between file creation and removal. Parallel requests referencing the temporary file through X-DSCGI-PATH allowed the Perl payload to execute before deletion.
The initial payload launched Bash and then an encoded Python stage that existed primarily in memory. At this point, the attacker obtained code execution as the lower-privileged cgi-server account.
To escalate privileges, UTA0576 chained a separate zero-day involving the privileged dsinvoked service and the DSCache configuration store. The attackers modified the in-memory copy of an Ivanti library, changed the configuration of a privileged maintenance task, and caused dsinvoked to execute attacker-controlled Perl code as root.
After achieving root access, the exploit restored the modified in-memory configuration and library state. It also removed relevant entries from Ivanti debug logs and Linux audit logs, significantly reducing the forensic artifacts available on disk.
This behavior is especially significant because Ivanti’s Integrity Checker Tool focuses on identifying unexpected file changes. Since portions of this exploit modify code only in memory and restore temporary configuration changes afterward, Volexity found that the attack could evade detection by the tool.
The attackers also did not install a conventional persistent web shell or first-stage backdoor. Instead, UTA0576 repeatedly executed the complete exploitation chain whenever another command needed to run and returned command output directly through the exploit’s HTTPS traffic.
Post-exploitation activity focused heavily on credentials and Active Directory. Volexity observed the attackers extracting credentials stored on the VPN appliance, querying Active Directory, searching for Windows LAPS passwords and BitLocker recovery keys, performing password spraying, inspecting authentication logs, and collecting LDAP traffic.
The threat actor also used custom Python and Kerberos tooling to test credentials and access sensitive directory attributes. Files associated with reconnaissance and credential collection were temporarily staged under /tmp/ before exfiltration and cleanup.
Attribution remains uncertain. Volexity tracks the actor as UTA0576 and assesses with low confidence that its motivation may be criminal rather than espionage. The researchers also assessed with medium confidence that the actor may have used large language models to assist with exploit development or post-exploitation activity, based on operational characteristics of the intrusion.
No broadly available, validated CVE-2026-104935 PoC was identified in the primary sources reviewed at publication time. However, Volexity has published substantial technical detail about the attack chain, meaning organizations should assume that additional actors may attempt to reproduce the technique.
For CVE-2026-104935 detection, defenders should monitor for high volumes of requests to /dana-na/auth/url_default/welcome.cgi, especially when the X-DSCGI-PATH header references another CGI resource or a temporary file.
CVE-2026-104935 Mitigation
Ivanti has released fixes for the authentication bypass and RCE components covered by the CVE. Organizations running affected Connect Secure releases should update immediately rather than relying solely on integrity checks.
Ivanti’s October security guidance identifies fixed releases across supported branches, including 22.8R2.5, 25.1.1.2, 25.1.3.0, and 25.1.3.1, depending on the deployed code line. Ivanti recommends moving to the 25.x branch as soon as practical because the 22.x code line is approaching end of life.
The separate privilege-escalation vulnerability used in the observed three-zero-day chain was not yet fixed when Volexity published its analysis on October 13. Ivanti was preparing a patch for a future release. This makes installation of the CVE-2026-104935 fixes especially important because blocking the initial authentication bypass and RCE prevents attackers from reaching the stage required to exploit the local privilege escalation.
Organizations should also continue running Ivanti’s Integrity Checker Tool, as recommended by the vendor, but should not treat a clean result as definitive evidence that exploitation has not occurred. Ivanti itself recommends combining updates and integrity checks with network monitoring, log review, access controls, and ongoing appliance validation.
To Detect CVE-2026-104935 exploitation, defenders should inspect HTTP telemetry for mismatches between the requested URL and the value of the X-DSCGI-PATH header. Particularly suspicious values observed by Volexity include paths referencing wu.cgi or files under /home/runtime/tmp/.
Security teams should also inspect /tmp/ for unexplained scripts or reconnaissance artifacts and investigate unexpected activity originating from the VPN appliance toward Active Directory, LDAP services, DNS infrastructure, or internal authentication systems.
Known CVE-2026-104935 IOCs from the investigated incident include the attacker-controlled IP address 108.165.147[.]64, suspicious activity involving /data/.icscap/, and repeated requests targeting the exposed welcome CGI path. These indicators should be used alongside behavioral detection because attackers can easily rotate infrastructure or alter temporary filenames.
Organizations that identify signs of compromise should conduct network and memory forensics rather than relying exclusively on disk-based examination. Credentials stored or accessible through the appliance should be considered potentially exposed, including LDAP service credentials, and should be rotated following containment.
Defenders should additionally investigate Active Directory for suspicious LDAP queries, password spraying, access to LAPS or BitLocker recovery attributes, anomalous Kerberos activity, and lateral movement originating from the VPN appliance.
CISA added the flaw to its Known Exploited Vulnerabilities catalog on October 13, 2026, establishing an October 16 remediation deadline for applicable U.S. federal civilian agencies. This confirms that organizations should treat patching as an urgent priority rather than waiting for broader exploitation.
SOC Prime’s AI-Native Detection Intelligence Platform can help security teams operationalize this threat intelligence, hunt for related behaviors, and adapt detections to available network, identity, and endpoint telemetry.
FAQ
What is CVE-2026-104935 and how does it work?
CVE-2026-104935 is an actively exploited vulnerability in Ivanti Connect Secure that covers an authentication bypass and remote code execution chain. Attackers can manipulate request-routing behavior to access a protected CGI handler without authentication and exploit temporary file handling to execute malicious code as the cgi-server account. In observed attacks, this was combined with a separate privilege-escalation zero-day to obtain root-level access.
When was CVE-2026-104935 first discovered?
Ivanti stated that its product security team had previously identified part of the vulnerability and included protection in the 25.1.3.0 release in July 2026. Volexity independently uncovered active exploitation while investigating suspicious activity on October 5, determining that attacks had begun by October 3. Ivanti publicly disclosed the vulnerability and confirmed limited exploitation on October 13, 2026.
What is the impact of CVE-2026-104935 on systems?
Successful exploitation allows an unauthenticated remote attacker to execute code on an affected Ivanti Connect Secure appliance. When chained with the separate privilege-escalation flaw observed by Volexity, attackers can obtain root privileges. In the investigated incident, UTA0576 stole credentials, queried Active Directory, searched for LAPS passwords and BitLocker recovery keys, captured LDAP data, and prepared for potential lateral movement.
Can CVE-2026-104935 still affect me in 2026?
Yes. Vulnerable Ivanti Connect Secure appliances that have not been upgraded remain at immediate risk because exploitation has been confirmed in the wild. CISA has added the vulnerability to its KEV catalog, while Ivanti urges customers running affected releases to upgrade without delay.
How can I protect myself from CVE-2026-104935?
Upgrade Ivanti Connect Secure to the applicable fixed release immediately, continue running the Integrity Checker Tool, and monitor network traffic and logs for suspicious request-routing behavior. Because the observed exploit can minimize disk artifacts, organizations with suspected exposure should conduct memory and network forensics and rotate potentially compromised credentials. Administrators should continue reviewing vendor guidance for updated details for CVE-2026-104935, including the pending fix for the separate privilege-escalation vulnerability.
