Ivanti Connect Secure auth bypass exploited; CISA gave agencies three days
CVE-2026-104935 lets an unauthenticated attacker bypass Ivanti Connect Secure's login with a crafted header and run commands. Exploited since early October by an actor that went on to harvest LDAP and Active Directory credentials. KEV deadline October 16.
CISA added CVE-2026-104935, an authentication bypass by spoofing (CWE-290, CVSS 8.6) in Ivanti Connect Secure, to its Known Exploited Vulnerabilities catalog on October 13 and gave federal agencies until October 16 to fix it. A remote, unauthenticated attacker can run commands on the VPN appliance; watchTowr traced it to one request with a crafted X-DSCGI-PATH header. Affected releases are 22.8R2.4, 25.1.1.1 and 25.1.2.2 and earlier; 22.8R2.5 and 25.1.3.0 and later are not affected. Volexity saw a group it tracks as UTA0576 exploiting it from October 3, chained with a privilege escalation flaw that remains unpatched, and leaving no malware behind. CISA says confirming compromise requires network and memory forensics, and that compromised appliances need a factory reset plus password, certificate and API key rotation.
Why it matters
The attackers did not stop at the appliance. Volexity reports they extracted stored credentials including LDAP domain accounts, hunted Active Directory for admin passwords and BitLocker recovery keys, captured LDAP traffic and ran Kerberoasting and password spraying. The VPN was the route to the directory.
So patching is step one of three. Rotate the LDAP bind account and everything the appliance stored, reset passwords on Kerberoastable service accounts, and look for directory authentication from the appliance's address since October 1. Our CVE-2026-104935 brief has the full list and the earlier Connect Secure bypass it echoes.
Source: The Hacker News
Related on Start with Identity
- BlogCISA adds the last two Ivanti Connect Secure chain flaws to KEV after Ivanti's October 29 patch
CISA added Ivanti Connect Secure CVE-2026-111357 and CVE-2026-118527 to its exploited list on October 30, a day after Ivanti patched the root escalation UTA0576
- BlogQilin and INC use the GlobalProtect auth bypass to skip MFA, then dump domain controller disks
Unit 42's October 19 update says Qilin and INC ransomware operators are exploiting CVE-2026-0257 in PAN-OS GlobalProtect to open VPN sessions without MFA, then
- BlogPEERSTITCH implant tags FortiOS VPN sessions to skip security checks
Unit 42 found an in-memory FortiOS implant that patches the IKE daemon so tagged VPN sessions bypass default security validations. Attackers reached root with C
- CVEIvanti Connect Secure root escalation, the last link in the UTA0576 chain
The privilege escalation UTA0576 chained with CVE-2026-104935 to reach root on fully patched Ivanti Connect Secure VPNs, then mine Active Directory. Patched Oct
- CVEIvanti Connect Secure SAML SSRF, chained to auth bypass
SSRF in the SAML component of Ivanti Connect Secure and Policy Secure. Attackers chained it with CVE-2023-46805 and CVE-2024-21887 after those were patched. CIS
- CVEAD FS elevation of privilege exploited as a zero-day
A low-privileged local user on an AD FS server could become administrator on the box that holds the federation token-signing keys. Microsoft saw exploitation be