---
schema: 1
kind: vulnerability
title: "CVE-2026-104935, Ivanti Connect Secure: an authentication bypass chained to code execution is exploited as a zero-day, and the root-escalation step of the chain is still unpatched (CVSS 8.6)"
headline: "Ivanti Connect Secure zero-day chain is exploited; its root step has no fix and it evades the Integrity Checker"
summary: >
  Ivanti disclosed CVE-2026-104935 on 2026-10-13, an authentication bypass in Connect Secure that lets a remote unauthenticated attacker run commands, and says it is aware of limited exploitation; CISA listed it in KEV the same day. Volexity found a cluster it calls UTA0576 chaining it with a root escalation that Ivanti has not yet fixed, patching library code in memory only so Ivanti's Integrity Checker Tool sees no file change, and going after the appliance's Active Directory service account, LAPS passwords and BitLocker recovery keys. Fixed builds are 25.1.1.2, 25.1.3.0 and 25.1.3.1, and 22.8R2.5; a patched appliance that was exposed still needs a compromise check.
discovered_at: "2026-10-14T03:38:00Z"
updated_at: null
event_date: "2026-10-13"
run_id: 2026-10-14T0255Z-intel
priority: critical
immediate_action:
  title: "Patch Ivanti Connect Secure now, then check the appliance and its AD account for compromise"
  action: >
    Ivanti and CISA confirm exploitation of CVE-2026-104935, and Volexity saw the chain used against a fully patched 22.8R2.4 appliance from 2026-10-03. Upgrade every Connect Secure appliance on 25.1.1.1 or earlier, 25.1.2.2 or earlier, or 22.8R2.4 or earlier to 25.1.1.2, 25.1.3.0 or 25.1.3.1, or 22.8R2.5, internet-facing ones first. Ivanti's Integrity Checker Tool cannot see this chain and the root-escalation step has no fix yet, so an appliance that was reachable on an affected build needs a compromise check and rotation of the Active Directory service account, LAPS passwords and other secrets it could reach.
tags: [vulnerabilities, zero-day, actively-exploited, pre-auth, rce, auth-bypass, cisa-kev, patch-available]
regions: [global]
sectors: [technology]
entities: ["product:ivanti-pulse-connect-secure", "actor:uta0576"]
techniques: [T1190, T1068, T1059.006, T1071.001, T1041, T1685.006, T1087.002, T1110.003, T1040]
affected_products: ["Ivanti Connect Secure"]
cves:
  - id: CVE-2026-104935
    cvss: "8.6"
    epss: null
    type: auth-bypass
    vector: zero-click
    auth: pre-auth
    status: [exploited, cisa-kev, patch-available]
    affected: "25.1.1.1 and prior, 25.1.2.2 and prior, 22.8R2.4 and prior (22.7.x and below not affected)"
    fixed: "25.1.1.2, 25.1.3.0 and 25.1.3.1, 22.8R2.5"
sources:
  - url: "https://www.ivanti.com/blog/october-2026-security-update"
    publisher: "Ivanti"
    date: "2026-10-13"
    role: primary
  - url: "https://www.volexity.com/blog/2026/10/13/a-series-of-unauthenticated-events-chained-exploitation-of-ivanti-connect-secure-zero-days/"
    publisher: "Volexity"
    date: "2026-10-13"
    role: primary
  - url: "https://www.rapid7.com/blog/post/etr-ivanti-connect-secure-zero-day-exploited-in-the-wild-cve-2026-104935/"
    publisher: "Rapid7"
    date: "2026-10-13"
    role: corroborating
  - url: "https://www.cisa.gov/news-events/alerts/2026/10/13/cisa-urges-patching-newly-exploited-vulnerability-ivanti-connect-secure"
    publisher: "CISA"
    date: "2026-10-13"
    role: corroborating
  - url: "https://cyber.gc.ca/en/alerts-advisories/ivanti-security-advisory-av26-1035"
    publisher: "Canadian Centre for Cyber Security"
    date: "2026-10-13"
    role: corroborating
closed_sources: []
evidence:
  - quote: "At the time of disclosure, Ivanti is aware of limited exploitation in the wild."
    publisher: "Ivanti"
    source_url: "https://www.ivanti.com/blog/october-2026-security-update"
  - quote: "In the first week of October 2026, Volexity discovered an unknown threat actor, UTA0576, abusing a zero-day exploit chain to compromise a fully patched (at the time, version 22.8R2.4) Ivanti Connect Secure (ICS) VPN appliance."
    publisher: "Volexity"
    source_url: "https://www.volexity.com/blog/2026/10/13/a-series-of-unauthenticated-events-chained-exploitation-of-ivanti-connect-secure-zero-days/"
  - quote: "because this exploit chain patches library code in memory only and restores configuration store data, the tool does not detect any modifications."
    publisher: "Volexity"
    source_url: "https://www.volexity.com/blog/2026/10/13/a-series-of-unauthenticated-events-chained-exploitation-of-ivanti-connect-secure-zero-days/"
  - quote: "Ivanti is working on a fix for the privilege escalation vulnerability, and it will be included in a future release in the coming weeks."
    publisher: "Volexity"
    source_url: "https://www.volexity.com/blog/2026/10/13/a-series-of-unauthenticated-events-chained-exploitation-of-ivanti-connect-secure-zero-days/"
  - quote: "apply the appropriate update on an emergency basis outside of normal patching cycles"
    publisher: "Rapid7"
    source_url: "https://www.rapid7.com/blog/post/etr-ivanti-connect-secure-zero-day-exploited-in-the-wild-cve-2026-104935/"
verification: multi-source
sourcing_note: "Ivanti's own advisory page is not readable without a browser, so the affected and fixed builds are taken from Rapid7's table of that advisory and the exploitation statement from Ivanti's blog; the Canadian Centre for Cyber Security's bulletin labels the 25.x affected line 25.2.2 and prior where Rapid7's table says 25.1.2.2 and prior."
confidence: high
references: []
deep_dive: false
deep_dive_category: null
org_triage: null
classification:
  reliability: A
  credibility: 1
watchlist_hit: false
actions:
  - "Upgrade every Ivanti Connect Secure appliance on 25.1.1.1 or earlier, 25.1.2.2 or earlier, or 22.8R2.4 or earlier to 25.1.1.2, 25.1.3.0 or 25.1.3.1, or 22.8R2.5 now, internet-facing appliances first; 22.7.x and below are not affected."
  - "Run a compromise check on every appliance that was reachable on an affected build, starting with proxy, load balancer or WAF logs back to at least 2026-10-03 for welcome.cgi requests that carry an X-DSCGI-PATH header; where compromise cannot be excluded, follow Ivanti's recovery steps and then reset the domain service account, LAPS and local passwords, certificates and API keys the appliance held."
updates: []
migrated_from: null
---

Ivanti disclosed a vulnerability in limited versions of Connect Secure on 2026-10-13 and says it is aware of limited exploitation in the wild ([Ivanti, 2026-10-13](https://www.ivanti.com/blog/october-2026-security-update)). Rapid7 describes CVE-2026-104935 as an authentication bypass by spoofing that lets a remote unauthenticated attacker run commands, and scores it CVSS 8.6 ([Rapid7, 2026-10-13](https://www.rapid7.com/blog/post/etr-ivanti-connect-secure-zero-day-exploited-in-the-wild-cve-2026-104935/)). CISA added CVE-2026-104935 to its Known Exploited Vulnerabilities catalog the same day ([CISA, 2026-10-13](https://www.cisa.gov/news-events/alerts/2026/10/13/cisa-urges-patching-newly-exploited-vulnerability-ivanti-connect-secure)). Volexity found the activity on 2026-10-05, tracks the operator as UTA0576, a previously unknown cluster it assesses with low confidence as criminal, and dates exploitation of a fully patched 22.8R2.4 appliance to 2026-10-03 ([Volexity, 2026-10-13](https://www.volexity.com/blog/2026/10/13/a-series-of-unauthenticated-events-chained-exploitation-of-ivanti-connect-secure-zero-days/)).

The chain has three steps. A request to the public login script `welcome.cgi` names a protected script in an `X-DSCGI-PATH` header, so the URL passes the authentication check while the header picks the destination. The upload script `wu.cgi` writes a file to disk before checking that it is a ZIP, and parallel requests run a Perl script before it is deleted. A root escalation then abuses the `dsinvoked` service's trust in the shared DSCache configuration store ([Volexity, 2026-10-13](https://www.volexity.com/blog/2026/10/13/a-series-of-unauthenticated-events-chained-exploitation-of-ivanti-connect-secure-zero-days/)). Ivanti tracks the first two steps under CVE-2026-104935 and has not fixed the root escalation, which it says will ship in a future release in the coming weeks ([Volexity, 2026-10-13](https://www.volexity.com/blog/2026/10/13/a-series-of-unauthenticated-events-chained-exploitation-of-ivanti-connect-secure-zero-days/)). Every command re-runs the whole chain over HTTPS with no web shell or backdoor, and the exploit patches library code in memory only, so Ivanti's Integrity Checker Tool, which looks for file changes, does not detect it; Volexity also found entries removed from the debug and audit logs ([Volexity, 2026-10-13](https://www.volexity.com/blog/2026/10/13/a-series-of-unauthenticated-events-chained-exploitation-of-ivanti-connect-secure-zero-days/)). The operator then went after the Active Directory service account stored on the appliance: LDAP queries for LAPS passwords, BitLocker recovery keys and password attributes, a Kerberoast-capable tool, password spraying, and packet capture of plaintext LDAP, HTTP Basic and NTLM traffic ([Volexity, 2026-10-13](https://www.volexity.com/blog/2026/10/13/a-series-of-unauthenticated-events-chained-exploitation-of-ivanti-connect-secure-zero-days/)).

**Exposure:** Connect Secure 25.1.1.1 and prior (fixed 25.1.1.2), 25.1.2.2 and prior (fixed 25.1.3.0 and 25.1.3.1) and 22.8R2.4 and prior (fixed 22.8R2.5) are affected, and 22.7.x and below are not ([Rapid7, 2026-10-13](https://www.rapid7.com/blog/post/etr-ivanti-connect-secure-zero-day-exploited-in-the-wild-cve-2026-104935/)); the Canadian Centre for Cyber Security labels the 25.x line 25.2.2 and prior ([Canadian Centre for Cyber Security, 2026-10-13](https://cyber.gc.ca/en/alerts-advisories/ivanti-security-advisory-av26-1035)). CISA says 22.8 reaches end of life on 2027-01-31 ([CISA, 2026-10-13](https://www.cisa.gov/news-events/alerts/2026/10/13/cisa-urges-patching-newly-exploited-vulnerability-ivanti-connect-secure)).

**Detection:** The appliance's own logs were tampered with, so start upstream: web proxy, load balancer or WAF logs for many requests to `welcome.cgi`, above all with an `X-DSCGI-PATH` header (the login page itself is ordinary) or one whose script differs from the URL path. On domain controllers, look for LDAP queries from the appliance's service account for LAPS, BitLocker recovery and password-bearing attributes, Kerberos activity and spraying from the appliance's address. Volexity names a hidden directory under the appliance's `/data` partition holding a renamed capture binary, and post-exploitation files in `/tmp`, says a clean Integrity Checker result does not show the appliance is safe, and advises network and memory forensics; patching does not evict an attacker who is already in.

**Defender takeaway:** Upgrade now, then treat every appliance that was exposed on an affected build as a compromise-assessment target and rotate what it could reach: the root-escalation step stays unfixed and the Integrity Checker cannot clear it. CISA's recovery sequence for a suspected compromise: back up the configuration, factory-reset and upgrade (rebuild cloud and virtual appliances), restore, then reset passwords, certificates, API keys and licence-server credentials ([CISA, 2026-10-13](https://www.cisa.gov/news-events/alerts/2026/10/13/cisa-urges-patching-newly-exploited-vulnerability-ivanti-connect-secure)).