CVE-2026-104935: Connect Secure authentication bypass chained into root access

What it is

CVE-2026-104935 is an authentication bypass by spoofing (CWE-290) in Ivanti Connect Secure. A remote attacker with no credentials can run arbitrary commands on the appliance. The CVE record lists it as exploited, and CISA added it to KEV on October 13, 2026.

Volexity found it being used as the first step of a three-part chain by an actor it calls UTA0576:

1. Authentication bypass. A request to welcome.cgi names a public URL path but a different, protected CGI script in the X-DSCGI-PATH header, and the appliance serves the protected one.
2. Remote code execution. An uploaded Perl script is written to disk before it is validated, and deleted afterward. A second request runs it inside that window.
3. Privilege escalation to root. The actor patches a library in memory so a maintenance task runs its script as root. This step has no CVE and no fix yet. Volexity says Ivanti is working on one for a future release.

So the patch closes the entry point, but the root step stays open until Ivanti ships its fix. Volexity saw the actor steal stored LDAP service credentials, query Active Directory for LAPS passwords and BitLocker recovery keys, run Kerberoasting and password spraying, and capture LDAP traffic for plaintext credentials. It left no web shell. It re-ran the chain for every command, and it tampered with logs and restored the memory patch.

NVD lists a CVSS 3.1 score of 8.6 (high) from a secondary source. watchTowr reports the vendor score as not yet assigned. CISA’s SSVC data marks exploitation as active and the bug as automatable.

Related: the same product has been exploited before, for example CVE-2025-0282 in January 2025.

Am I affected?

You’re affected if you run Connect Secure in one of these ranges, per watchTowr and the NVD record. Ivanti’s own advisory page wouldn’t load for us, so confirm against it.

Branch	Affected	Fixed
25.1.2.x and earlier	25.1.2.2 and earlier	25.1.3.0, 25.1.3.1
25.1.1.1 on ISA6000 and ISA8000	25.1.1.1	25.1.1.2
22.8 bridge release	22.8R2.4 and earlier	22.8R2.5

Not affected: ICS 22.7R2.14 and earlier, per the CVE record. Ivanti has not described any special configuration, so assume any reachable appliance is exposed. The attack needs only network access to the web interface.

Check your version in the appliance admin console. We could not confirm a vendor menu path or CLI command, so none is given here.

Shadowserver tracks over 5,500 internet-exposed Connect Secure instances, per BleepingComputer, though some may be honeypots.

What to do

1. Upgrade now to the fixed build for your branch (see the table above). Moving to 25.1.3.0 or later needs new ISA4500, ISA6500 or ISA8500 hardware, or a rebuilt virtual or cloud appliance, per watchTowr. If you can’t do that tonight, the interim fixes are 22.8R2.5 and 25.1.1.2.
2. Before you change anything, preserve logs and system images from the appliance (watchTowr’s summary of Ivanti’s guidance). Upgrading destroys evidence you may need.
3. Restrict access to the management and gateway interfaces where you can. This is watchTowr’s summary of Ivanti’s advice. Ivanti has not published a workaround that replaces patching, as far as we could confirm.
4. Plan your exit from 22.7 and 22.8. Both lines reach end of life on January 31, 2027, per watchTowr.
5. If the appliance was reachable while vulnerable, treat it as possibly compromised. The Integrity Checker Tool will not catch this, so do not rely on a clean result. Do network and memory forensics, and follow Ivanti’s recovery guidance.
6. Rotate what the appliance could read. That means the LDAP service account and other stored credentials. Review exposure of LAPS passwords and BitLocker recovery keys in Active Directory. Volexity doesn’t list these as formal steps, but they follow from what it saw the actor take.
7. Watch for the root-escalation fix. Apply it as soon as Ivanti releases it.

CISA’s due date for federal agencies is October 16, 2026. Its required action is to apply vendor mitigations and follow BOD 26-04, including the forensic triage requirements.

Detection

From Volexity’s analysis:

• Web logs: high volumes of requests to /dana-na/auth/url_default/welcome.cgi, especially where the X-DSCGI-PATH header doesn’t match the URL path. Header values seen: /home/webserver/htdocs/dana/fb/smb/wu.cgi and /home/runtime/tmp/<MD5 of filename>.
• Files: the paths in the indicators table, especially ics-root-run-inband-*.pl and ics-root-result-inband-* in /home/runtime/tmp/, the .py files in /tmp/, and anything under /data/.icscap/.
• Processes: dsstatmond running from a .icscap directory. It is a renamed tcpdump. Also look for /home/venv3/bin/python3.6 running h.py.
• Tampered logs: gaps or odd edits in /home/runtime/dlogs/debuglog and /var/log/audit/audit.log.
• Network: connections from 108.165.147[.]64, and lateral movement, LDAP queries or password spraying that start at the appliance.
• In Active Directory: unusual queries for LAPS passwords, BitLocker recovery keys and password-bearing attributes, and Kerberoasting activity from the appliance’s service account.

Search back to at least October 1, 2026, when Defused first saw exploitation. Volexity’s iocs.csv and YARA rules are in its GitHub repository.