Published: Wed 14 October 2026
Prepared by: Brandon Sawyer, Vulnerability Analyst
On 13 October 2026, Ivanti disclosed a zero-day authentication bypass vulnerability in Ivanti Connect Secure (ICS), assigned CVE-2026-104935, and confirmed it had already been exploited in the wild against a limited number of customers. The flaw allows a remote, unauthenticated threat actor with network access to an affected appliance to bypass authentication and execute arbitrary commands. On the same day, the US Cybersecurity and Infrastructure Security Agency (CISA) added the vulnerability to its Known Exploited Vulnerabilities (KEV) catalog and issued an alert urging patching, noting threat actors are using it for credential theft and data exfiltration.
CVE-2026-104935 is an authentication bypass by spoofing vulnerability (CWE-290) in Ivanti Connect Secure, Ivanti's enterprise SSL VPN appliance. It carries a CVSS base score of 8.6 (High) and vector string of CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L. Ivanti's advisory does not describe any special configuration being required, meaning network access to the appliance is sufficient for a threat actor to attempt exploitation, with no credentials or user interaction needed.
According to watchTowr, the root cause is straightforward. A single HTTP request carrying a specially crafted X-DSCGI-PATH header is enough to bypass authentication and reach functionality that should be restricted to logged-in users. Volexity reports that the CVE covers two distinct flaws in the exploit chain it observed, an authentication bypass and a remote code execution (RCE) bug. A third flaw used in the chain, a local privilege escalation that takes the threat actor from the web process to root, is not covered by this CVE and remains unpatched; Ivanti plans to address it in the coming weeks.
The vulnerability was reported to Ivanti by Volexity following an incident response engagement. Ivanti states part of the issue had already been fixed in the 25.1.3.0 release in July 2026, with the remainder backported to other release lines for this advisory.
Discovery and Disclosure Timeline
| Date | Event |
| Jul 2026 | Ivanti releases ICS 25.1.3.0, which already contains part of the fix |
| 3 Oct 2026 | Earliest evidence of in-the-wild exploitation identified by Volexity |
| Early Oct 2026 | Volexity discovers threat actor UTA0576 using a zero-day exploit chain against a fully patched ICS 22.8R2.4 appliance during an incident response engagement, and reports it to Ivanti |
| 13 Oct 2026 | Ivanti publishes its advisory and fixed versions 22.8R2.5, 25.1.1.2, 25.1.3.0 and 25.1.3.1, confirming exploitation against a limited number of customers |
| 13 Oct 2026 | CISA adds CVE-2026-104935 to the KEV catalog and issues an alert urging patching; Volexity, Rapid7 and watchTowr publish analysis |
| Ongoing | Ivanti and third-party researchers continue to monitor and refine guidance |
Successful exploitation grants a threat actor unauthenticated command execution on the ICS appliance, and when chained with the unpatched privilege escalation flaw, full root access. Because ICS is an internet-facing VPN gateway that brokers authentication into the corporate network, a compromised appliance can expose:
Volexity's investigation of the threat actor it tracks as UTA0576 illustrates this. The threat actor stole domain credentials from the appliance, exfiltrated limited Active Directory metadata, and used a custom tool to query AD for LAPS passwords and BitLocker recovery keys. It also ran password spraying, validated credentials with a custom Kerberos tool, attempted to harvest credentials from captured traffic, scanned the internal network and tampered with logs. Volexity found no web shell or backdoor on the device, and the intrusion was disrupted before the threat actor's end goal was clear, though Volexity assesses with high confidence the activity was preparation for wider compromise.
Ivanti Connect Secure has an extensive exploitation history, with zero-days exploited in both 2024 and 2025, and watchTowr notes 14 other Ivanti Connect Secure and Pulse Connect Secure vulnerabilities already in the KEV catalog. Given how simple the root cause is, mass exploitation is probable and swift patching processes should be prioritised.
Primary Remediation
The primary remediation is to upgrade all Ivanti Connect Secure appliances to the fixed version for their release line:
| Release Line | Affected Versions | Fixed Version |
| 25.1.x | 25.1.2.2 and prior | 25.1.3.0, 25.1.3.1 |
| 25.1.1.x(ISA6000 / ISA8000) | 25.1.1.1 | 25.1.1.2 |
| 22.8.x (bridge release) | 22.8R2.4 and prior | 22.8R2.5 |
| 22.7.x and earlier | Not Affected | N/A |
Ivanti Connect Secure 22.7.x and earlier do not contain the vulnerability. However, both the 22.7 and 22.8 lines reach end of life on 31 January 2027, and the 22.8.x line is intended only as a temporary bridge to 25.1. Rapid7 recommends applying the update on an emergency basis outside normal patching cycles.
Note that migrating to 25.1.3.0 requires new ISA4500, ISA6500 or ISA8500 hardware, or a virtual or cloud appliance rebuilt from the new template. Organisations not ready for that migration should apply the interim fix in 22.8R2.5 or 25.1.1.2 now and plan the move to 25.1.3.x before the 22.7 and 22.8 lines reach end of life on 31 January 2027.
Before patching, preserve logs and system images from affected appliances so a compromise investigation remains possible. Applying the fix closes the initial entry point but does not remove a threat actor who has already gained access, and it does not address the separate privilege escalation flaw, which remains unpatched. Organisations whose appliances were internet-exposed and unpatched at any point since 3 October 2026 should follow Ivanti's recovery guidance and review for compromise regardless of current patch status.
Compensating Controls
Where immediate patching is not possible, the following controls can reduce exposure in the interim:
X-DSCGI-PATH header, if the architecture allows it and legitimate traffic is unaffectedThese measures are stop-gaps only. They will not remove any persistence or credentials a threat actor obtained before they were applied, and full patching remains the priority.
Hardening and Longer-Term Actions
If compromise is suspected or cannot be ruled out, rotate all credentials stored on or accessible to the appliance, including domain service accounts, LDAP bind accounts and local administrator passwords. Given the threat actor's targeting, also consider rotating LAPS-managed passwords and BitLocker recovery keys that may have been queried from Active Directory. Review whether service accounts used by ICS hold more AD privileges than they need, and continue to monitor Ivanti's advisory, CISA and ACSC guidance for the pending privilege escalation fix and any published indicators.
Indicators and Log-Based Detection
Ivanti states there are no reliable indicators of compromise (IOCs) for this vulnerability at this time, and recommends that organisations suspecting compromise follow its recovery guidance rather than relying on a single scan or signature. Prior Five Eyes reporting on Ivanti appliances also found threat actors could deceive Ivanti's Integrity Checker Tool, so a clean integrity check alone should not be treated as proof the appliance is uncompromised.
In the absence of vendor IOCs, the following hunting leads are derived from the published root cause and Volexity's reporting on UTA0576, and should be treated as a starting point rather than a complete picture:
X-DSCGI-PATH header, where web or proxy logs capture request headersRecommended Detection and Hunting Activities
Organisations with questions about recovery, or that identify suspected exploitation, can contact Ivanti Support directly for assistance.
MDR customers: Triskele Labs will continue tuning detections and analysing IOCs for behaviours consistent with the exploitation of CVE-2026-104935 across supported log sources.
Vulnerability Management customers: Environments will be assessed for vulnerable versions of Ivanti Connect Secure affected by CVE-2026-104935 once detections are made available. Any findings will be communicated through priority channels.