Ivanti Connect Secure CVE-2026-104935: Exploited Zero-Day

What to do

1. Upgrade to the fixed Connect Secure release named in Ivanti's advisory (25.1.3.0 per the CVE record)
2. Do not rely on the Integrity Checker Tool alone; capture memory and network evidence if exposure dates overlap October 1 or later
3. Hunt welcome.cgi requests whose X-DSCGI-PATH header does not match the URL path
4. Rotate credentials that passed through the VPN, including AD service accounts, since the actor harvested NTLM hashes and ran Kerberoasting
5. Watch for Ivanti's fix for the still-unpatched privilege escalation and apply it on release
6. Restrict ICS admin interfaces and alert on outbound connections from the appliance

How to check if you are affected or compromised

• Search web logs for high volumes of requests to /dana-na/auth/url_default/welcome.cgi
• Look for files in /tmp/ (ml.py, rq5.py, mk.py, rr.py, sp_out.txt, spray_hits.json) and /data/.icscap/
• Look for a process named dsstatmond (renamed tcpdump) and tampering in debuglog or audit.log
• Check traffic to 108.165.147[.]64 and for LDAP queries pulling LAPS or BitLocker attributes from the ICS address

What happened#

On October 13, 2026, Ivanti disclosed CVE-2026-104935 in Connect Secure (ICS), its SSL VPN. The CVE record describes "authentication bypass by spoofing in ICS before version 25.1.3.0" that "allows a remote unauthenticated attacker to execute arbitrary commands." Ivanti's CNA score is CVSS 3.1 8.6, which reads low for unauthenticated command execution. Ivanti's October security update says it is "aware of limited exploitation in the wild" and tells affected customers to "act immediately." CISA added the flaw to the KEV catalog the same day, with a three-day federal deadline and a forensic-triage requirement.

Volexity, which found and reported the flaw, saw exploitation from October 3 against a customer's ICS that was fully patched at 22.8R2.4. The chain combined an authentication bypass in welcome.cgi, a file write and race condition in wu.cgi, and a privilege escalation in which the dsinvoked broker trusts DSCache data, yielding root. Ivanti has fixed the first two under this CVE. The privilege escalation has no fix yet; Volexity reports Ivanti expects one "in the coming weeks." Defused reportedly saw first activity on October 1, per BleepingComputer.

Volexity tracks the actor as UTA0576, a previously unknown group. It assesses with low confidence that the motive is criminal, and with medium confidence that the actor uses LLMs in its tooling. After getting in, the actor captured packets to harvest credentials and NTLM hashes, ran Kerberoasting and password spraying, and queried LDAP for LAPS passwords and BitLocker keys.

Who is affected#

Sources differ on scope. NVD says ICS before 25.1.3.0 is affected and 22.7R2.14 or earlier is not. BleepingComputer lists 22.8R2.4 and earlier, 25.1.2.2 and earlier, and 25.1.1.1 and earlier. Ivanti's advisory page would not load for us, so confirm the fixed build for your branch there. Shadowserver tracked more than 5,500 exposed ICS instances, per BleepingComputer.

Do you really need to act?#

Yes, if you run ICS. It is reachable without credentials on the device's public face, and it worked against a fully patched appliance. Two details raise the stakes beyond a normal patch cycle. First, the chain patches a library in memory only and restores the cache entry, so Ivanti's Integrity Checker Tool did not detect the compromise; Volexity says forensic investigation is required. Second, the actor "deployed no malware or web shell" and re-exploited the device for each command, so there may be no persistent implant to find. Exploitation is described as limited today. Given Ivanti's history (BleepingComputer counts 36 Ivanti CVEs in KEV since 2021), plan for that to change.

What to do now#

1. Upgrade to the fixed release in Ivanti's advisory (25.1.3.0 per the CVE record).
2. If the appliance was exposed on or after October 1, capture memory and packet data before or alongside the upgrade. Do not treat a clean ICT result as clearance.
3. Rotate credentials that authenticated through or to the VPN, AD service accounts exposed to Kerberoasting, and any LAPS or BitLocker secrets the ICS service account could read.
4. Subscribe to Ivanti advisories and apply the privilege escalation fix as soon as it ships.
5. Alert on outbound connections and LDAP queries originating from the ICS appliance.

How to tell if you were hit#

Volexity's indicators: many requests to /dana-na/auth/url_default/welcome.cgi with an X-DSCGI-PATH header pointing at /home/webserver/htdocs/dana/fb/smb/wu.cgi or /home/runtime/tmp/; files such as /tmp/ml.py, /tmp/mk.py, /tmp/rr.py, /tmp/spray_hits.json and /data/.icscap/h.py; a dsstatmond process (renamed tcpdump); ics-root-run-inband-*.pl under /home/runtime/tmp/; tampering in debuglog and audit.log; and contact with 108.165.147[.]64. On the internal side, look for spraying, Kerberos service-ticket requests and LDAP reads originating from the appliance's IP.

Timeline#

• Oct 1, 2026 — First signs of activity, per Defused.
• Oct 3, 2026 — Exploitation observed by Volexity on a fully patched 22.8R2.4 appliance.
• Oct 5, 2026 — Volexity begins its investigation.
• Oct 13, 2026 — Ivanti discloses and patches; CISA adds the CVE to KEV.
• Oct 21, 2026 — Privilege escalation in the chain still unpatched as of writing.

Vulnerability records

• CVE-2026-104935 · KEV 2026-10-13 · Authentication bypass by spoofing in ICS before version 25.1.3.0 allows a remote unauthenticated attacker to execute arbitrary commands.

Sources

Original sources first: vendor and project advisories, CVE and government records, the discoverers’ write-ups. Every claim above links to one of these. See how the Security Desk works.

Original and primary sources

1. NVD — CVE-2026-104935 nvd.nist.gov
2. Ivanti — October 2026 Security Update ivanti.com
3. Volexity — A Series of Unauthenticated Events: Chained Exploitation of Ivanti Connect Secure Zero-Days volexity.com
4. CISA — Known Exploited Vulnerabilities catalog (JSON feed) cisa.gov

Coverage and analysis

1. BleepingComputer — Ivanti warns of Connect Secure zero-day exploited in attacks bleepingcomputer.com