Ivanti Connect Secure CVE-2026-104935: exploited auth bypass chain

The Ivanti Connect Secure appliance Volexity investigated was fully patched. It ran 22.8R2.4, the newest release at the time, when an unknown actor began running commands on it as root. The route was three bugs in a row: an authentication bypass, a file write and a privilege escalation. The chain patched code only in memory and put configuration back afterward, so Ivanti's Integrity Checker found nothing.

Volexity traced the exploitation to 3 October 2026 and began its investigation on 5 October. Ivanti disclosed CVE-2026-104935, covering the first two bugs, on 13 October, and CISA added it to its Known Exploited Vulnerabilities catalog the same day with a 16 October deadline. The privilege escalation received its own identifier, CVE-2026-111357, on 15 October. We have found no confirmed patch for it.

Who is affected

Connect Secure on the 22.8 and 25.1 lines. CISA lists the affected versions, and Ivanti's CVE record lists the versions that are not affected:

NVD's analysis and CISA's affected list imply that 25.1.1.2 is fixed, but Ivanti's CVE record does not list it, so confirm it in Ivanti's advisory before relying on it.

No login is needed: Ivanti describes a remote, unauthenticated attacker. CISA notes that 22.8 reaches end of life on 31 January 2027.

How the Connect Secure chain works

Volexity documented three steps. Ivanti tracks the first two as CVE-2026-104935, an authentication bypass by spoofing (CWE-290) that it scores 8.6 in CVSS 3.1.

Step 1: welcome.cgi trusts a routing header

welcome.cgi answers requests without authentication. Volexity found that it can be steered to a different, protected CGI script named in the X-DSCGI-PATH request header. That turns a public page into a way to reach scripts that should require a login.

Step 2: wu.cgi writes before it checks

wu.cgi, an upload handler, saves the uploaded file to a temporary path derived from an MD5 hash of the filename, and only then checks whether it is a valid ZIP archive. Combined with the routing header, that gave the attacker command execution.

Step 3: dsinvoked trusts DSCache

The last step abuses how the dsinvoked broker trusts DSCache configuration data, which lets commands run as root. MITRE assigned it CVE-2026-111357 and scores it 7.0 in CVSS 3.1 (CWE-829), listing 22.8R2.4 as affected. On 13 October Volexity said Ivanti was working on a fix for a future release "in the coming weeks". NVD had not finished analyzing the CVE, and it was not in CISA's KEV catalog as of the 26 October edition.

The actor left no web shell. Volexity found that every command re-ran the full chain, patching library code in memory and restoring configuration data afterward.

Is it being exploited?

Yes. CISA lists CVE-2026-104935 in KEV, added 13 October with a 16 October deadline and forensic triage required. Volexity's account adds the detail:

• Actor. UTA0576, previously unknown. Volexity assesses with low confidence that the motive is criminal and with medium confidence that the actor used large language models for exploit development.
• Timeline. Exploitation from 3 October 2026 against one customer's appliance.
• What followed. Theft of domain credentials stored on the appliance, LDAP searches for LAPS administrator passwords and BitLocker recovery data, Kerberoasting, password spraying, packet capture, and selective deletion of log entries.

Some reporting cites activity from 1 October; we could not confirm that date against a primary source.

Check your exposure

Confirm your version in the appliance's admin console and compare it with the table. If a reverse proxy, load balancer or WAF in front of the appliance keeps request logs, search them for the request pattern Volexity published:

# Volume of requests to the endpoint the chain abuses
grep -cF "/dana-na/auth/url_default/welcome.cgi" access.log
 
# Requests carrying the routing header, if your proxy logs headers
grep -i "X-DSCGI-PATH" access.log

welcome.cgi is a normal page, so the signal is volume and the header, not the path alone.

Fix it

Upgrade to 22.8R2.5, 25.1.3.0 or 25.1.3.1, following Ivanti's advisory and its 25.x upgrade and migration compatibility guide. With 22.8 reaching end of life on 31 January 2027, plan the move to 25.1 now.

If you suspect compromise, CISA's recovery steps are:

1. Back up the appliance configuration.
2. Factory reset and upgrade to the latest version; for virtual and cloud appliances, rebuild the instance and upgrade.
3. Restore the configuration from the backup.
4. Reset passwords for every account: domain, administrator and local.
5. Revoke and reissue stored certificates, and reset stored API keys and license server credentials.

Detect attempts and compromise

Volexity published these signals. Most of the host artifacts surface only in a forensic image of the appliance:

• Request pattern. Large volumes of requests to /dana-na/auth/url_default/welcome.cgi whose X-DSCGI-PATH header points at /home/webserver/htdocs/dana/fb/smb/wu.cgi or at a file under /home/runtime/tmp/. Any mismatch between the URL path and that header deserves a look.
• Temporary files. ml.py, rq5.py, mk.py, rr.py, pu.txt, sp_out.txt and spray_hits.json in /tmp/, plus ics-root-run-inband-*.pl under /home/runtime/tmp/.
• Hidden capture. A /data/.icscap/ directory and a renamed tcpdump running as dsstatmond.
• Log gaps. Missing entries in /home/runtime/dlogs/debuglog and /var/log/audit/audit.log.
• Directory queries. LDAP searches from the appliance for LAPS passwords, BitLocker recovery data or userPassword attributes.
• Infrastructure. 108.165.147[.]64, which Volexity tied to the operation.

Volexity says related indicators are on its GitHub page. If any of these signals fired, assume the directory credentials the appliance holds are exposed and follow the recovery steps above.

Beyond this patch

Integrity checks that compare files on disk cannot see an attacker who works in memory and tidies up afterward. For closed appliances, the durable evidence is network traffic and logs kept off the box. Confirm a fix with that kind of evidence, not a version string; how a retest verifies a fix explains the approach Rokkhe takes for findings it has reproduced.