CVE-2026-104935Ivanti Connect Secure authentication bypass by spoofed header, exploited as a zero-day

What broke

CVE-2026-104935 (CVSS 8.6, CWE-290 authentication bypass by spoofing) lets a remote, unauthenticated attacker skip Ivanti Connect Secure's authentication and run commands. watchTowr traced the root cause to a single request carrying a crafted X-DSCGI-PATH header that reaches an internal CGI handler the login was supposed to guard.

Affected: 22.8R2.4 and earlier, 25.1.1.1 and earlier, and 25.1.2.2 and earlier. Releases 22.8R2.5, 25.1.3.0 and 25.1.3.1 are not affected, and 22.7R2.14 and earlier never were. CISA added the flaw to its Known Exploited Vulnerabilities catalog on October 13, 2026 with an October 16 deadline.

Volexity saw an actor it tracks as UTA0576 exploiting it from October 3, chained with a privilege escalation flaw in the dsinvoked broker, to reach root on an appliance that was fully patched at the time. Volexity found no first-stage malware or web shell, only helper scripts written to /tmp. The chain evaded Ivanti's Integrity Checker Tool because it patched library code in memory only and restored the configuration store afterwards, leaving nothing on disk for the tool to flag; the attacker re-ran the whole chain for each command.

Update, October 31, 2026: the privilege escalation in this chain was unpatched when this brief was first published. Ivanti patched it on October 29 as CVE-2026-111357, and CISA added it to KEV on October 30. NVD lists 22.8R2.5 as still affected by CVE-2026-111357, so the fix for this CVE alone does not close the chain.

Why it matters

A VPN gateway exists to decide who is allowed inside, so a bypass here turns an anonymous internet request into a position past the front door. What UTA0576 did next is the identity lesson: it pulled stored credentials, including LDAP domain credentials, from the appliance, searched Active Directory for administrator passwords and BitLocker recovery keys, captured LDAP traffic, and ran Kerberoasting and password spraying. The gateway was a stepping stone to the directory.

This is the same product and failure class as CVE-2023-46805 and the SAML SSRF in CVE-2024-21893.

What to do

• Upgrade to 22.8R2.5 or 25.1.3.0 or later, then apply Ivanti's October 29 patch for CVE-2026-111357. Version 22.8 reaches end of life on January 31, 2027.
• Alert on inbound requests carrying an X-DSCGI-PATH header.
• Do not treat a clean Integrity Checker result as proof of safety. CISA says determining compromise needs network and memory forensics.

After you patch

• If compromise is found, CISA's sequence is: back up the configuration, factory reset and upgrade (or rebuild virtual instances), restore, then reset all account passwords and revoke and reissue certificates, API keys and license server credentials.
• Rotate the LDAP bind account and any domain credentials the appliance stored.
• Reset Kerberoastable service account passwords and review directory logs for spraying from the appliance's address.

Sources

• NVD: CVE-2026-104935
• Ivanti security advisory
• CISA Known Exploited Vulnerabilities catalog
• Volexity, October 13, 2026