CVE-2026-104935, Ivanti Connect Secure: an authentication bypass chained to code execution is exploited as a zero-day, and the root-escalation step of the chain is still unpatched (CVSS 8.6)

Ivanti disclosed a vulnerability in limited versions of Connect Secure on 2026-10-13 and says it is aware of limited exploitation in the wild (Ivanti, 2026-10-13). Rapid7 describes CVE-2026-104935 as an authentication bypass by spoofing that lets a remote unauthenticated attacker run commands, and scores it CVSS 8.6 (Rapid7, 2026-10-13). CISA added CVE-2026-104935 to its Known Exploited Vulnerabilities catalog the same day (CISA, 2026-10-13). Volexity found the activity on 2026-10-05, tracks the operator as UTA0576, a previously unknown cluster it assesses with low confidence as criminal, and dates exploitation of a fully patched 22.8R2.4 appliance to 2026-10-03 (Volexity, 2026-10-13).

The chain has three steps. A request to the public login script welcome.cgi names a protected script in an X-DSCGI-PATH header, so the URL passes the authentication check while the header picks the destination. The upload script wu.cgi writes a file to disk before checking that it is a ZIP, and parallel requests run a Perl script before it is deleted. A root escalation then abuses the dsinvoked service's trust in the shared DSCache configuration store (Volexity, 2026-10-13). Ivanti tracks the first two steps under CVE-2026-104935 and has not fixed the root escalation, which it says will ship in a future release in the coming weeks (Volexity, 2026-10-13). Every command re-runs the whole chain over HTTPS with no web shell or backdoor, and the exploit patches library code in memory only, so Ivanti's Integrity Checker Tool, which looks for file changes, does not detect it; Volexity also found entries removed from the debug and audit logs (Volexity, 2026-10-13). The operator then went after the Active Directory service account stored on the appliance: LDAP queries for LAPS passwords, BitLocker recovery keys and password attributes, a Kerberoast-capable tool, password spraying, and packet capture of plaintext LDAP, HTTP Basic and NTLM traffic (Volexity, 2026-10-13).