Ivanti Connect Secure zero-day CVE-2026-104935: affected versions, exploit chain and detection

On 13 October 2026 Ivanti released a fix for CVE-2026-104935, a vulnerability in Ivanti Connect Secure that lets an unauthenticated remote attacker run commands on the VPN gateway. The company acknowledges that it was exploited as a zero-day against "a limited number of customers" before disclosure. CISA added it to its Known Exploited Vulnerabilities (KEV) catalogue the same day, with a 16 October deadline for US federal agencies.

Volexity's investigation describes a chain of three flaws, and the last one, which escalates privileges to root, is still unfixed. The attacker it observed installed no malware, tried to wipe its traces from the logs and went after Active Directory credentials. Ivanti's Integrity Checker Tool (ICT) does not detect that activity.

What is the Ivanti Connect Secure vulnerability CVE-2026-104935?

CVE-2026-104935 is an authentication bypass by spoofing (CWE-290) in Ivanti Connect Secure that lets an unauthenticated remote attacker execute arbitrary commands, according to Ivanti's security advisory. The vendor rates it CVSS 8.6 (high), with the vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L. The advisory covers Connect Secure only and does not mention Policy Secure or the ZTA gateways.

Ivanti explains in the same advisory that its product security programme found part of the flaw and fixed it in version 25.1.3.0, released in July. It was backporting the fix to the other branches when exploitation began. According to CyberScoop, the company had spotted it in June and decided it did not warrant an out-of-band release.

Which Ivanti Connect Secure versions does CVE-2026-104935 affect?

The affected versions are 25.1.1.1 and earlier, 25.1.2.2 and earlier, and 22.8R2.4 and earlier, according to Ivanti's advisory. The 22.7 branch, up to and including 22.7R2.14, does not contain the flaw.

The 22.7 and 22.8 branches reach end of support on 31 January 2027, and Ivanti describes 22.8 as a temporary bridge to 25.1. Moving to 25.1.3.0 requires the new ISA4500, ISA6500 or ISA8500 appliances, and virtual and cloud installations have to be rebuilt from that version's template. Gateways on the 25.1.1 branch can apply 25.1.1.2 without changing platform.

How does the exploit chain described by Volexity work?

The chain Volexity published on 13 October 2026 combines an authentication bypass in welcome.cgi, code execution in wu.cgi and privilege escalation to root through dsinvoked. Volexity found it on a customer's device that was fully patched at version 22.8R2.4, with activity from 3 October, according to its technical analysis.

• The first flaw is the authentication bypass. The request goes to the public path /dana-na/auth/url_default/welcome.cgi with an X-DSCGI-PATH header pointing to a protected script. Access control checks the URL, but the header decides which script runs.
• The second is code execution. The wu.cgi upload handler writes a Perl script with a .zip extension to disk before checking that it is a valid ZIP, and the attacker runs it with parallel requests before it is deleted. The code runs as the cgi-server user.
• The third is privilege escalation. The attacker modifies the libdsplibs.so library in memory and redirects a maintenance task stored in DSCache so that the dsinvoked process runs its script as root. It then restores the DSCache entry and the library.

CVE-2026-104935 covers the first two steps. Volexity says Ivanti is working on a fix for the privilege escalation, due "in a future release in the coming weeks". That flaw has no publicly assigned CVE.

Who is exploiting the vulnerability and what do they do inside the network?

Volexity attributes the initial intrusion to UTA0576, an actor it had not seen before, which used the gateway to steal Active Directory credentials without installing malware. It assesses with low confidence that this is a criminal actor, not an espionage one, and with medium confidence that it uses large language models to develop the exploit and for post-exploitation work. Volexity has not linked it to the China-nexus groups associated with earlier Ivanti zero-days.

UTA0576 re-ran the whole chain for each command and received the output through the same HTTPS channel. It went after the credentials that pass through the device:

• It extracted the domain credentials the gateway uses to query LDAP.
• It ran a renamed copy of tcpdump (/data/.icscap/dsstatmond) to capture traffic and harvest cleartext LDAP credentials, HTTP Basic credentials and NTLM responses.
• It queried Active Directory for LAPS passwords, BitLocker recovery information and the userPassword and unixUserPassword attributes.
• It deployed a Python Kerberos tool capable of Kerberoasting, used it to test credentials and ran a password-spraying attack.

The attacker also edited the /home/runtime/dlogs/debuglog and /var/log/audit/audit.log files to remove entries from its activity window, and deleted its scripts when done. Volexity describes no backdoor or other persistence mechanism, and does not confirm that the LAPS or BitLocker secrets were used.

Other attackers have tried to exploit the flaw since the advisory was published. By 15 October, Previdian had recorded 109 exploitation attempts from 51 IP addresses against its honeypots, and a Nuclei template to detect vulnerable devices was released on 14 October. Shadowserver counted more than 5,600 Connect Secure instances exposed online that day, without saying how many remain unpatched, according to BleepingComputer.

Why does the Integrity Checker Tool miss the compromise?

Ivanti's Integrity Checker Tool misses this intrusion because the chain alters the library only in memory and restores the configuration data it changes, according to Volexity. CISA's alert of 13 October warns that the tool may not detect exploitation because the commands execute in memory, and calls for network and memory forensics.

A clean ICT result therefore does not rule out compromise. France's CERT-FR notes that Ivanti recommends the external version of the tool, which needs physical access and can interrupt service, and for virtual installations asks for a snapshot of the file system and memory before anyone touches the appliance.

How can exploitation of CVE-2026-104935 be detected?

Evidence of exploitation has to be sought mainly off the device, because the attacker removes its entries from the local logs, according to Volexity. Its indicators of compromise are in its GitHub repository, with a CSV list and YARA rules. Look for the following:

• Requests to /dana-na/auth/url_default/welcome.cgi with an X-DSCGI-PATH header that does not match the requested path, such as /home/webserver/htdocs/dana/fb/smb/wu.cgi. They are only visible if a reverse proxy, WAF or network sensor logs headers.
• Unusual request volumes to welcome.cgi, a sign of the race condition used to run the script in wu.cgi.
• Connections to 108.165.147[.]64, the attacker's infrastructure according to Volexity.
• Files in /data/.icscap/ and Python scripts in /tmp/ on the device, or a process called dsstatmond.
• Gateway logs forwarded to the SIEM that are missing from, or differ from, those kept on the device, because the attacker edits the local copies.

On the domain controllers, the gateway's LDAP service account should not query LAPS or BitLocker attributes, nor request service tickets in bulk. A spike in Kerberos service ticket requests using RC4 encryption (event 4769) or in authentication failures (events 4625 and 4771) originating from the gateway points to Kerberoasting or password spraying. Decoy accounts in Active Directory help to catch that reconnaissance.

Those signals should be reviewed retrospectively from late September, for example through a threat hunting exercise, and then monitored by a managed SOC that receives the gateway's logs.

Should an unpatched Ivanti Connect Secure gateway be treated as compromised?

An Ivanti Connect Secure gateway left exposed without the patch since late September should be updated immediately and treated as possibly compromised. BleepingComputer reported that the security firm Defused saw the first attempts on 1 October, and Volexity researcher Sean Koessel told CyberScoop it would not surprise him if there had been activity in late September.

Updating does not evict an attacker who already holds credentials. If compromise is suspected, the recommendations of CISA and CERT-FR include these steps:

• Isolate the gateway from the internet and the internal network, and take a disk and memory snapshot if it is virtual, as CERT-FR advises.
• Back up the configuration, factory reset and upgrade, or fully rebuild virtual and cloud appliances, before restoring the configuration, as CISA advises. Digital forensics carried out beforehand preserves the evidence a reset destroys.
• Change the LDAP and Active Directory secrets configured on the gateway, starting with the service account, along with administrator and local passwords. CERT-FR says it is aware of lateral movement using those secrets, and CISA asks for every account password to be reset, domain accounts included.
• Revoke and reissue the certificates stored on the gateway, and renew API keys, licence server credentials and Kerberos tickets.

If domain controller logs show the gateway querying LAPS or BitLocker attributes, the affected local administrator passwords and recovery keys should also be renewed. CERT-FR notes that some threats can survive a factory reset. An incident response retainer avoids negotiating a contract in the middle of the incident.

Is any part of the chain still unpatched?

The privilege escalation through dsinvoked was still unpatched on 15 October 2026, according to Volexity. An attacker who finds another way to run code as cgi-server could reuse it, so monitoring for the signals above should continue until Ivanti ships the fix.

What do Spain's CCN-CERT, GDPR and NIS2 require after CVE-2026-104935?

Spain's CCN-CERT issued alert CCN-CERT AL 10/26 on 14 October 2026, rated high severity. It recommends updating, reviewing Volexity's indicators, running the ICT periodically, applying Ivanti's recovery steps if there are signs of exploitation and reviewing internal traffic leaving the gateway to rule out lateral movement.

If a gateway giving access to systems with personal data is confirmed as compromised, the credential theft may require notifying the relevant supervisory authority (the AEPD in Spain, the ICO in the UK) within 72 hours under Article 33 of the GDPR. Entities subject to NIS2 will have to send an early warning within 24 hours if the incident is significant, under Article 23 of the directive, although in Spain that obligation depends on the transposition law, which is still pending.

Which other Ivanti Connect Secure zero-days have been exploited?

CVE-2026-104935 is the fourth time critical Connect Secure flaws have been exploited in under three years. In January 2024, CVE-2023-46805 and CVE-2024-21887 led CISA to issue Emergency Directive ED 24-01 and later to order federal agencies to disconnect these devices temporarily. CVE-2025-0282 was exploited as a zero-day in January 2025.

In April 2025 CVE-2025-22457 was exploited on unpatched devices, although Ivanti had fixed it in February without identifying it as a security flaw. CISA's KEV catalogue lists 36 Ivanti vulnerabilities since 2021.

How can an Ivanti Connect Secure gateway be hardened against future flaws?

The VPN gateway is a recurring target because it is exposed to the internet, stores domain credentials and cannot run an EDR agent. We covered this in our analysis of EDR blind spots on network devices. In the NetScaler case, web shells installed before the patch were still active after it was applied.

The service account the gateway uses against the directory should have minimal permissions and should not be able to read LAPS or BitLocker attributes, in line with the Active Directory tiering model. That way, stealing the account does not expose local administrator passwords or recovery keys.

CISA's BOD 26-04 sets three days to fix KEV entries that give full control of a system and requires forensic triage, as we analysed in an earlier article. That deadline is a useful benchmark outside the US federal government too.

Sources and attribution: this analysis draws on Ivanti's security advisory, Volexity's research, alerts from CISA, CCN-CERT and CERT-FR, and coverage by CyberScoop and BleepingComputer. It reflects the information available on 15 October 2026.

UTA0576 is Volexity's name for this activity cluster, and its assessment that the motive is criminal carries low confidence and may change. This article does not suggest flaws in products other than those listed in Ivanti's advisory.

Technical notice: the checks described are indicative. Any reset or rebuild of the gateway should be planned with the network owner and, if compromise is suspected, carried out after evidence has been preserved. Published indicators may be extended, so the current versions should be checked at the original sources.