Ivanti disclosed CVE-2026-104935 on October 13. It is an authentication bypass in Ivanti Connect Secure (ICS), the company's widely deployed VPN appliance, and it lets a remote, unauthenticated attacker run commands on the device. Attackers were using it before the advisory came out. Ivanti describes the activity as "limited exploitation in the wild" and urged customers to "act immediately." CISA added the flaw to its Known Exploited Vulnerabilities (KEV) catalog the same day.

Incident response firm Volexity reported more. In the case it investigated, the attacker used CVE-2026-104935 to get in and then used a third, separate privilege-escalation flaw to take root on the appliance. That appliance was fully patched and running 22.8R2.4. Ivanti has not fixed the third flaw yet. According to The Hacker News, the fix will ship "in a future release in the coming weeks."

Rapid7 rates CVE-2026-104935 at CVSSv3.0 8.6 and classifies it as CWE-290 (Authentication Bypass by Spoofing). Shadowserver tracks more than 5,600 internet-exposed hosts with ICS fingerprints, as BleepingComputer reported, though it is unclear how many of those are already secured or are honeypots.

Timeline

  • July 2026: Ivanti releases ICS 25.1.3.0. Rapid7 says that release already fixed part of the flaw, which Ivanti found through its own product security program. Exploitation happened while Ivanti was still porting the fix to its other supported versions.
  • October 1: Security firm Defused sees the first evidence of exploitation in the wild, according to BleepingComputer.
  • October 3: Volexity says the actor it tracks as UTA0576 starts exploiting the appliance it later investigated.
  • October 13 (Tuesday): Ivanti publishes its advisory. CISA adds CVE-2026-104935 to KEV and urges patching. Volexity's findings on the exploit chain are reported the same day.
  • Friday, October 16: Deadline for federal civilian agencies to secure their systems under Binding Operational Directive 26-04, according to BleepingComputer, which reported a Friday deadline following CISA's Tuesday KEV addition.

What the flaw does and which versions are affected

CISA describes CVE-2026-104935 as a zero-day authentication bypass that allows remote, unauthenticated execution of arbitrary commands. Attackers used it for credential theft and data exfiltration. Volexity's account, as reported by The Hacker News, breaks the CVE into two parts: an authentication bypass and a remote code execution flaw that runs code as the appliance's cgi-server user. That user does not have root privileges. The attacker needed the third, separate flaw to escalate from there to root.

According to CISA and Rapid7, the affected versions are:

  • 25.1.1.1 and prior
  • 25.1.2.2 and prior
  • 22.8R2.4 and prior

Rapid7 lists the fixed releases as 25.1.1.2, 25.1.3.0, 25.1.3.1 and 22.8R2.5. CISA's alert directs organizations to update to the latest version described in Ivanti's security advisory.

Rapid7 cites the vendor advisory as saying versions 22.7.x and below are unaffected. CISA notes that the ICS 22.8 branch reaches end of life on January 31, 2027. Organizations still on 22.8 should plan their migration now, separately from this patch.

What the attacker did after getting in

The Hacker News reports that Volexity saw UTA0576 steal credentials stored on the appliance, including LDAP domain credentials, search Active Directory for passwords, and run password-spraying attacks. Volexity found no backdoor or web shell left behind; the attacker reran the full chain for each command. That fits CISA's warning that the attacker's commands execute in memory.

On motive, Volexity assessed with low confidence that UTA0576 is criminally motivated rather than conducting espionage. No named source has attributed the activity to a nation-state, and this report does not either.

Why detection is hard

CISA says Ivanti's Integrity Checker Tool (ICT), the usual first check on ICS appliances, may not detect this exploitation because the commands run in memory, and that forensics are needed to determine whether a system was compromised. Ivanti says reliable indicators of compromise (IOCs) are not available at the time of the advisory, though Rapid7 notes that Volexity has published several indicators. Rapid7 "strongly recommends looking for signs of compromise even after the patch has been applied."

Taken together, a clean ICT scan does not show that an appliance is safe, and a patched appliance may still have been compromised before the update. The Volexity case shows the pattern: the victim had applied every available patch and was still compromised, because the attacker used flaws that had no fix at the time.

What It Means for Defenders

Based on guidance from CISA, Rapid7 and the reporting above:

  • Patch now. Move to a fixed release for your branch: 22.8R2.5, 25.1.3.0 or 25.1.3.1, or 25.1.1.2. These releases fix CVE-2026-104935. They do not fix the third privilege-escalation flaw Volexity described. Ivanti says that fix is coming in a later release.
  • Note the KEV deadline. The federal deadline, October 16, has passed.
  • Don't rely on the Integrity Checker Tool alone. CISA warns it may miss in-memory exploitation. Review appliance logs, authentication records and outbound traffic from the appliance, starting from late September. Defused saw activity as early as October 1.
  • Use the indicators that exist. Ivanti has no reliable IOCs yet, but Volexity has published network and host indicators from its investigation. Check your appliance logs and traffic against them. In particular, look for large volumes of requests to /dana-na/auth/url_default/welcome.cgi with a mismatched X-DSCGI-PATH header, the indicator Volexity described.
  • Hunt downstream as well as on the appliance. Volexity saw theft of LDAP and stored credentials, Active Directory password searches and password spraying. Look for unusual LDAP binds from the VPN appliance, a spike in failed logins across your directory, and logins with service accounts that the appliance knows. Rotate LAPS passwords and BitLocker recovery keys readable from Active Directory, which Volexity says the actor targeted.
  • If you suspect compromise, follow CISA's recovery steps. Back up the configuration, factory reset the appliance (rebuild cloud and virtual instances), upgrade to the latest version, and restore the configuration. Then reset passwords for all accounts, reissue and revoke stored certificates, and reset stored API keys and license-server credentials.
  • Watch for the next Ivanti release. Apply the fix for the third flaw as soon as Ivanti ships it, and watch for any IOCs Ivanti or CISA publish later.
  • Check other Ivanti products. The Hacker News reports that Ivanti also disclosed two CVSS 9.9 flaws in other products with no reported exploitation: CVE-2026-106042 in Xtraction and CVE-2026-109412 in Neurons Patch for Intune. Patch them on a normal schedule.

Context

BleepingComputer counts 36 Ivanti flaws that CISA has added to KEV since November 2021. Twelve of them were used in ransomware attacks. Exploitation of VPN and remote-access appliances follows a familiar sequence: initial access through an edge device, then credential theft, then lateral movement into the directory. The attack Volexity documented follows that sequence. Because Ivanti has no reliable IOCs and one flaw in the chain is still unpatched, defenders should treat this as an ongoing incident until the final fix ships.

Sources