CVE-2026-104935: The Ivanti Connect Secure Zero-Day Exploit Chain, Explained

Read this in 30 seconds: CVE-2026-104935 is an authentication bypass in Ivanti Connect Secure that lets a remote, unauthenticated attacker run commands on the VPN appliance, and it was exploited before most branches had a fix. Ivanti published its advisory on October 13, 2026, and CISA added it to the Known Exploited Vulnerabilities catalog the same day, with a deadline of October 16 and a forensic-triage flag.

• Patching is not the whole job. Volexity found a three-bug chain, and the privilege-escalation link is still unpatched, with Ivanti promising a fix “in the coming weeks.”
• A clean integrity scan does not clear you. Volexity says Ivanti’s Integrity Checker “may not be able to identify device compromise,” and CISA says the attacker’s commands execute in memory.
• Exploitation beat most of the patches. Volexity saw it starting October 3, 2026. The fix for the 25.1.1.x train, 25.1.1.2, shipped October 5, and the 22.8 fix, 22.8R2.5, shipped October 12.
• The affected builds are 25.1.1.1, 25.1.2.2 and 22.8R2.4 and below. The fixes are 25.1.1.2, 25.1.3.0 or 25.1.3.1, and 22.8R2.5. Version 22.7R2.14 and earlier is not affected.
• The attacker went after Active Directory. Volexity saw stored LDAP credentials extracted, LAPS and BitLocker data targeted, and password spraying against Active Directory accounts.

A VPN gateway has one job, being reachable from the internet and trusted from the inside, and that combination is exactly what makes a bug in it so expensive.

Ivanti Connect Secure has been here before. Our pull of the CISA catalog shows 14 entries across the Connect Secure and Pulse Secure family, and 8 of them carry a known-ransomware flag. This one is the first Connect Secure addition since April 2025, and Ivanti’s own advisory says exploitation was “affecting a limited number of customers at the time of disclosure.”

This article covers what the advisory and the research say about CVE-2026-104935, which builds are affected, how the chain works at the level that has been published, what the attacker did, which indicators you can hunt for today (with commands we tested), and the order to fix things in. It also says plainly what nobody has published yet.

Why CVE-2026-104935 Matters: What Ivanti Connect Secure Is

Ivanti Connect Secure, formerly Pulse Connect Secure, is a VPN appliance. Remote staff connect to it from the internet, and it hands them a path into the internal network. That means it sits on the one boundary an attacker most wants to cross.

It also holds the keys. Volexity found domain credentials stored on the appliance, and CISA’s recovery steps tell you to rotate certificates, API keys and license server credentials. A compromise there is not a single compromised server, and Volexity’s account of this attack shows why.

What CVE-2026-104935 Is, According to Ivanti

Ivanti’s advisory (article 000109571, created October 13, 2026) describes it in one sentence: “Authentication bypass by spoofing in ICS before version 25.1.3.0 allows a remote unauthenticated attacker to execute arbitrary commands.” It adds that this does not impact version 22.7R2.14 or prior.

The record carries these facts:

• Weakness: CWE-290, authentication bypass by spoofing.
• Severity: Ivanti rates it 8.6 (High), with the vector CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L. NVD lists the same metrics under 3.1, scored by a secondary source.
• Exploited: yes. Ivanti says it is “aware of exploitation affecting a limited number of customers.”
• Prioritization: CISA’s record in NVD lists exploitation as active, automatable as yes, and technical impact as total.
• Discovered by: Ivanti thanks Volexity, whose write-up we rely on below.

The advisory for CVE-2026-104935 also admits something unusual. Ivanti says it “initially discovered a portion of this vulnerability as part of our product security program and patched it in the July release 25.1.3.0,” and was backporting the fix when exploitation began. That is the whole story of the timeline, so keep it in mind.

Which Builds Are Affected by CVE-2026-104935, and Which Are Fixed

Ivanti lists three affected trains, and the fixed build for each is different. This is where estates trip up, because 25.1.2.x does not have a simple point release to move to.

Train and platform	Affected	Fixed	Catch
25.1.1.x (ISA6000, ISA8000 physical; ISA4000, ISA6000, ISA8000 virtual)	25.1.1.1 and prior	25.1.1.2 (released Oct 5)	The simplest path
25.1.2.x	25.1.2.2 and prior	25.1.3.0 (July) or 25.1.3.1	New platform required: ISA4500, ISA6500 or ISA8500, or a new virtual build from the 25.1.3.0 template
22.8.x	22.8R2.4 and prior	22.8R2.5 (released Oct 12)	Ivanti prefers moving to 25.1.1.2 or later; 22.8 is end of life on January 31, 2027
22.7.x	Not affected (22.7R2.14 and earlier)	Not needed	End of life on January 31, 2027

Ivanti calls 22.8 “only meant to be a temporary bridge from 22.7 to 25.1.” Read that as a warning: if you are on 22.8 today, the interim fix buys you time, not a destination.

Check a version list for CVE-2026-104935 with a script

If you manage more than a handful of appliances, do not eyeball version strings when you triage CVE-2026-104935. This script, which we wrote and tested against every build in the advisory, classifies a version against the table above.

import re, sys

def parse(v):
    v = v.strip().upper().replace(" ", "")
    m = re.fullmatch(r"(\d+)\.(\d+)R(\d+)\.(\d+)", v)      # 22.8R2.4
    if m:
        return ("R", int(m[1]), int(m[2]), int(m[3]), int(m[4]))
    m = re.fullmatch(r"(\d+)\.(\d+)\.(\d+)\.(\d+)", v)     # 25.1.1.1
    if m:
        return ("N", *map(int, m.groups()))
    raise ValueError(f"unrecognised version: {v!r}")

def verdict(version):
    kind, *n = parse(version)
    if kind == "R":
        major, minor, rel, patch = n
        if (major, minor) <= (22, 7):
            return "not affected (22.7 and earlier)"
        if (major, minor) == (22, 8):
            return ("AFFECTED, update to 22.8R2.5 or move to 25.1.1.2+"
                    if (rel, patch) <= (2, 4) else "fixed (22.8R2.5 or later)")
    else:
        a, b, c, d = n
        if (a, b) == (25, 1):
            if (c, d) <= (1, 1):
                return "AFFECTED, update to 25.1.1.2"
            if c == 1:
                return "fixed (25.1.1.2 or later)"
            if (c, d) <= (2, 2):
                return "AFFECTED, move to 25.1.3.0 or 25.1.3.1 (new platform)"
            return "fixed (25.1.3.0 or later)"
    return "unknown branch: check Ivanti's advisory"

for v in sys.argv[1:]:
    print(f"{v:>10}  {verdict(v)}")

Run it against a list and you get an answer per appliance:

python3 ics_check.py 22.7R2.14 22.8R2.4 22.8R2.5 25.1.1.1 25.1.2.2 25.1.3.1
# 22.7R2.14  not affected (22.7 and earlier)
#  22.8R2.4  AFFECTED, update to 22.8R2.5 or move to 25.1.1.2+
#  22.8R2.5  fixed (22.8R2.5 or later)
#  25.1.1.1  AFFECTED, update to 25.1.1.2
#  25.1.2.2  AFFECTED, move to 25.1.3.0 or 25.1.3.1 (new platform)
#  25.1.3.1  fixed (25.1.3.0 or later)

This is our illustration of Ivanti’s table, not an Ivanti tool. Treat the advisory as the authority, and treat any version string you did not read from the appliance itself as a guess.

How the CVE-2026-104935 Chain Works, and What Is Actually Public

Here is the part that most coverage flattens. Ivanti’s advisory lists one CVE, CVE-2026-104935, and calls it “one high severity vulnerability.” Volexity describes a chain of three.

Per Volexity, the attacker combined three things: “An authentication bypass in ICS welcome.cgi allowing requests to be routed to arbitrary CGI files,” “A file write vulnerability in wu.cgi” with a race condition between execution and deletion, and “A privilege escalation vulnerability in how the ICS dsinvoked broker trusts DSCache configuration data.” Volexity maps the bypass and the code execution to CVE-2026-104935. It gives no CVE for the privilege escalation.

We will not describe the requests, because the vendor and the researchers have not published a working recipe and we are not going to reconstruct one. What matters for a defender is the shape.

• The entry is patched, the root step is not. Volexity says Ivanti is “working on a fix for the privilege escalation vulnerability” that will arrive in a future release in the coming weeks.
• The chain was re-run for every command. Volexity says it “did not identify first-stage malware or web shells,” and that “For each command executed by UTA0576, the entire exploit chain is executed.” That is why file checks can come up empty.
• A fully patched 22.8R2.4 was compromised. Volexity says the appliance was “fully patched (22.8R2.4, Build 19097)” at the time, and that this was the latest version. That build is on the affected list, so it fits, but it shows why “we are on the latest” was never an answer.

Our reading, and it is an inference: closing the first two links removes the way in, and the unpatched privilege escalation is only reachable once an attacker already runs code. That makes patching urgent and still not sufficient on its own, which is why the recovery steps below matter.

The CVE-2026-104935 Timeline: Who Knew What, and When

The dates are the argument for CVE-2026-104935. Exploitation began before the fix existed for the 25.1.1.x and 22.8 trains.

Date	Event	Source
July 2026	Ivanti ships 25.1.3.0 with a partial fix	Ivanti advisory
Oct 3	UTA0576 starts repeatedly exploiting the chain	Volexity
Oct 5	Volexity begins an investigation at a monitoring customer; 25.1.1.2 released	Volexity; Ivanti
Oct 12	22.8R2.5 released	Ivanti
Oct 13	Advisory, Volexity blog, CISA alert, KEV entry	Ivanti; Volexity; CISA
Oct 16	KEV due date	CISA KEV catalog
“Coming weeks”	Privilege escalation fix	Volexity
Jan 31, 2027	22.7 and 22.8 end of life	Ivanti

Two days passed between the first exploitation Volexity saw and 25.1.1.2, the first fix for the 25.1.1.x train, and nine days passed before 22.8R2.5. The July build 25.1.3.0 was already free of the bug, but it needs new hardware or a new virtual build, so for most estates there was nothing quick to apply.

What the Attacker Did After CVE-2026-104935

Volexity says the chain was “exploited by a previously unknown threat actor that Volexity tracks as UTA0576.” Its account of the post-exploitation is the best reason to treat this as more than “patch and move on.”

The actor “Extracted credentials stored on the ICS VPN appliance, such as domain credentials used with LDAP.” It also went after Windows Local Administrator Password Solution (LAPS) credentials and BitLocker recovery information.

It deployed “a custom Kerberos tool capable of Kerberoast attacks and credential testing,” ran password-spraying attacks against Active Directory accounts, and used a renamed tcpdump executable at /data/.icscap/dsstatmond. Volexity also lists the appliance’s debug and audit logs among the paths the actor touched.

Volexity states that it “assesses with medium confidence that UTA0576 makes use of large language models (LLMs) for exploit development and post-exploitation activity.” That is a medium-confidence assessment from one vendor, and we cannot verify it. It is still the detail that explains the speed: the time between a fix and a working attack keeps shrinking.

The operation was detected and disrupted, so the final goal is unknown. Volexity assesses “with high confidence that UTA0576’s actions signaled preparation for lateral movement.”

Indicators You Can Hunt for After CVE-2026-104935

Ivanti says “limited indicators of compromise” are available and points to Volexity’s blog and repository. Volexity keeps the full set in its threat-intel repository, and the post lists these inline:

• IP address: 108.165.147[.]64
• Renamed sniffer: dsstatmond (PID 5012), running from /data/.icscap/
• Scripts and files: /data/.icscap/h.py, /tmp/ml.py, /tmp/rq5.py, /tmp/mk.py, /tmp/rr.py, /tmp/pu.txt, /tmp/sp_run.py, /tmp/sp_out.txt, /tmp/spray_hits.json
• Other paths: /home/bin/updateOpswatSDK.pl, /home/lib/libdsplibs.so, /home/runtime/tmp/ics-root-run-inband-.pl, /home/runtime/tmp/ics-root-result-inband-
• Logs the actor targeted: /home/runtime/dlogs/debuglog and /var/log/audit/audit.log

Run this on a forensic copy of the appliance, never on the live device. It checks a mounted image for the paths above, which is the fastest first pass for any CVE-2026-104935 case:

#!/usr/bin/env bash
ROOT="${1:?path to mounted image}"
hits=0
for p in data/.icscap \
  tmp/ml.py tmp/rq5.py tmp/mk.py tmp/rr.py tmp/pu.txt tmp/sp_run.py \
  tmp/sp_out.txt tmp/spray_hits.json \
  'home/runtime/tmp/ics-root-run-inband-*' \
  'home/runtime/tmp/ics-root-result-inband-*'
do
  for f in $ROOT/$p; do
    [ -e "$f" ] && { echo "FOUND  $f"; hits=$((hits+1)); }
  done
done
echo "$hits indicator path(s) present"
[ "$hits" -eq 0 ] || exit 1

Volexity’s detection advice for CVE-2026-104935 is simple: “Monitor for large numbers of network requests for /dana-na/auth/url_default/welcome.cgi.” If you keep web or proxy logs in front of the appliance, a per-source count is a start. This is our example, and it will produce false positives on busy login pages:

awk '/\/dana-na\/auth\/url_default\/welcome\.cgi/ {n[$1]++}
     END {for (ip in n) print n[ip], ip}' access.log | sort -rn

Volexity also says monitoring for mismatches between the URL path and the X-DSCGI-PATH header is “advisable.” We are not publishing a rule for that, because the matching logic is not public and a guess would bury you in noise.

The Forensic Step Comes Before the CVE-2026-104935 Fix

CISA flags CVE-2026-104935 for forensic triage, and the reasoning is stark. CISA’s alert says the Integrity Checker may miss exploitation “because threat actor commands execute in memory.” Volexity says the Ivanti Integrity Checker “may not be able to identify device compromise.”

So do not treat a clean Integrity Checker result as a finish line. Before you patch or reboot anything:

1. Capture memory and network evidence from the appliance and the network path to it.
2. Preserve logs and a configuration backup. Patching or a factory reset will overwrite what you need.
3. Record the exact version and the date it was last upgraded, so the timeline above can be applied to your estate.

Fixing CVE-2026-104935 in the Right Order

Work through these in order, and note where CISA’s guidance goes beyond the CVE-2026-104935 patch.

1. Inventory every appliance and version. Use the script above, and include any development or disaster-recovery units.
2. Update to the right fixed build for CVE-2026-104935: 25.1.1.2, 25.1.3.0 or 25.1.3.1, or 22.8R2.5. Ivanti recommends leaving the 22.8 line for 25.1.1.2 or later.
3. Plan the platform change for 25.1.2.x. Moving to 25.1.3.x needs ISA4500, ISA6500 or ISA8500 hardware, or a new virtual build from the 25.1.3.0 template.
4. If compromise is possible, recover, do not just patch. CISA says to back up the configuration, conduct a factory reset and upgrade (or rebuild virtual instances), and restore the configuration. It then says to reset passwords for “all accounts, including domain, administrator, and local accounts,” revoke and reissue stored certificates, and reset stored API keys and license server credentials.
5. Hunt in Active Directory. Volexity’s account shows the target was the directory, so look for LDAP bind anomalies, Kerberoasting activity and password spraying from the appliance’s address.
6. Track the privilege escalation fix. It is not yet released, so re-check Ivanti’s advisory over the coming weeks.

We found no interim mitigation in the sources we read. CISA’s alert names none beyond patching and the recovery steps.

Pattern Check: CVE-2026-104935 and Connect Secure in the KEV Catalog

We counted this from the catalog file itself, and you can check the entry for CVE-2026-104935 the same way:

curl -s https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json \
  | jq '.vulnerabilities[] | select(.cveID=="CVE-2026-104935")
        | {cveID, dateAdded, dueDate, forensicTriage, knownRansomwareCampaignUse}'
# {
#   "cveID": "CVE-2026-104935",
#   "dateAdded": "2026-10-13",
#   "dueDate": "2026-10-16",
#   "forensicTriage": "Yes",
#   "knownRansomwareCampaignUse": "Unknown"
# }

The numbers above come from the same file. Of 14 entries for the Connect Secure and Pulse Secure family, 8 carry CISA’s known-ransomware flag. The flag on CVE-2026-104935 is “Unknown,” which means it has not been linked to ransomware yet, not that it never will be.

Before this addition, the most recent Connect Secure entry was CVE-2025-22457, added April 4, 2025. The catalog does not say why the gap closed now, and neither do we.

Where the Sources Disagree About CVE-2026-104935

Point	Source A	Source B	What we used
CVSS version label	Ivanti: CVSS:3.0 vector, 8.6	NVD: same metrics under 3.1, secondary source	Ivanti’s 3.0 label, noted NVD
Unaffected 22.7 build	Ivanti description: “22.7R2.14 or prior”	Ivanti solution text: “22.7.14 and lower”	22.7R2.14 and earlier
Due date	CISA KEV file: October 16	CISA alert: “immediately,” no formal date	October 16, from the KEV file
How many bugs	Ivanti: one CVE	Volexity: three bugs, one without a CVE	Both, labeled
Exploitation start	Volexity: October 3	One secondary report: October 1, unsourced	October 3

How XHack Reads CVE-2026-104935

So yeah, this is where we mention our own work. Handling a VPN bug like CVE-2026-104935 starts with inventory, not a clever exploit. Knowing which appliances exist, which are exposed and which version each runs is most of the job.

Our AI VAPT services combine automated and human-led testing against exposed infrastructure, and the exposure review above is part of that kind of work. On infrastructure you own, XHack AI’s autonomous pentesting covers reconnaissance, port scanning and service enumeration, and the agent streams its work to a live terminal so you can watch what it runs. A pentest report documents what was tested. It does not certify that a gateway is patched or clean, and it does not replace the update or the forensic work. XHack does not store your data, and your session data stays on your own computer.

FAQ: CVE-2026-104935 Questions Answered

What is CVE-2026-104935?

CVE-2026-104935 is an authentication bypass by spoofing (CWE-290) in Ivanti Connect Secure that lets a remote, unauthenticated attacker execute arbitrary commands. Ivanti rates it 8.6 (High) and says it has been exploited. Volexity describes it as part of a three-bug chain.

Is CVE-2026-104935 being exploited?

Yes. Ivanti says it is “aware of exploitation affecting a limited number of customers,” and CISA added it to the Known Exploited Vulnerabilities catalog on October 13, 2026. Volexity saw the actor UTA0576 exploiting it from October 3.

Which versions are affected by CVE-2026-104935?

Ivanti Connect Secure 25.1.1.1 and prior, 25.1.2.2 and prior, and 22.8R2.4 and prior. Version 22.7R2.14 and earlier, and 25.1.3.0 and later, are not affected.

How do I fix CVE-2026-104935?

Update to 25.1.1.2, 25.1.3.0 or 25.1.3.1, or 22.8R2.5, depending on your train. If you suspect compromise, follow CISA’s recovery steps: factory reset and upgrade, restore the configuration, and reset passwords, certificates and API keys.

Does the Integrity Checker Tool detect CVE-2026-104935 compromise?

Not reliably. Volexity says the Integrity Checker “may not be able to identify device compromise,” and CISA says the attacker’s commands execute in memory. Treat a clean result as incomplete evidence, and use memory and network forensics.

Is there a patch for the privilege escalation in the chain?

Not yet. Volexity says Ivanti is working on a fix that will ship in a future release in the coming weeks, and Ivanti’s advisory does not cover it.

The Bottom Line on CVE-2026-104935

CVE-2026-104935 is an exploited Ivanti Connect Secure authentication bypass, part of a three-bug chain whose last link is still unpatched. Exploitation started two days before the first fixed build, and the integrity tool may not see it.

Inventory your appliances, preserve the evidence, then patch to the right build and recover if there is any doubt. The fix is available now. The expensive part is finding every gateway you forgot you had.