CVE-2026-104935
Ivanti Connect Secure Authentication Bypass and Remote Code Execution Vulnerability
CVE-2026-104935 is an authentication bypass by spoofing vulnerability in Ivanti Connect Secure (ICS) that allows a remote, unauthenticated attacker to execute arbitrary commands. Ivanti assigns it a CVSS 3.1 score of 8.6 (High) and has confirmed exploitation affecting a limited number of customers. CISA added the vulnerability to its Known Exploited Vulnerabilities catalog on October 13, 2026, and reports attacks involving credential theft and data exfiltration.
Technical Details
The authentication bypass stems from inconsistent request handling: ICS checks the requested URL for authentication requirements but uses an attacker-controlled header to select the CGI script that executes. This allows unauthenticated requests to reach protected functionality.
Attackers combine this bypass with a file-write issue in the wu.cgi upload handler, executing uploaded code before the handler deletes it. Both components are tracked under CVE-2026-104935 and enable execution as the cgi-server user. In the observed attacks, a separate privilege-escalation vulnerability provided root access.
Exploitation requires network access to a vulnerable appliance, with no valid credentials or user interaction required. The vulnerability is classified as CWE-290: Authentication Bypass by Spoofing, with the CVSS 3.1 vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L.
Stop Guessing, Start Proving
NodeZero® Proactive Security Platform Rapid Response
A NodeZero Rapid Response test has been developed to safely validate whether this vulnerability can be exploited in your environment. The test executes real attack techniques without causing damage, giving teams immediate clarity on exposure.
- Run the Rapid Response test: Launch from the NodeZero platform to determine whether exploitation is possible.
- Patch immediately: Upgrade to a fixed version appropriate for your appliance and software branch.
- Re-run the test: Confirm the vulnerability is no longer exploitable after remediation.
Indicators of Compromise
Volexity documented these files during its investigation of the attack chain. They are investigation leads, not an exhaustive detection checklist. Their absence does not rule out compromise.
| Indicator | Type | Description |
/tmp/ml.py and /tmp/rq5.py | File | LDAP tooling used to query Active Directory. |
/data/.icscap/h.py | File | Script used to extract authentication data from packet captures. |
/data/.icscap/dsstatmond | File | Renamed tcpdump executable used for traffic capture. |
X-DSCGI-PATH: /home/runtime/tmp/{MD5 checksum} | Inbound HTTP Request Header | Inbound requests from non-internal sources containing this header are highly suspect |
X-DSCGI-PATH: /home/webserver/htdocs/dana/fb/smb/wu.cgi | Inbound HTTP Request Header | Inbound requests from non-internal sources containing this header are highly suspect |
CISA warns that Ivanti’s Integrity Checker Tool may miss evidence of this exploitation because attacker commands execute in memory. Organizations assessing potential compromise should conduct network and memory forensics rather than relying on a clean integrity-check result.
Affected versions & patch
Affected
NVD identifies the following affected versions:
- ICS 25.1.0.0 through 25.1.1.1.
- ICS 25.1.2.0 through 25.1.2.2.
- ICS 22.8R2 through 22.8R2.4.
Ivanti states that ICS 22.7R2.14 and earlier are not affected by this vulnerability.
Fixed
| Affected versions | Fixed release |
| ICS 25.1.0.0 through 25.1.1.1 | 25.1.1.2 |
| ICS 25.1.2.0 through 25.1.2.2 | 25.1.3.0 or 25.1.3.1 |
| ICS 22.8R2 through 22.8R2.4 | 22.8R2.5 |
Use Ivanti’s upgrade and migration guidance to select a compatible release for your hardware or virtual appliance. Ivanti recommends moving ICS 22.8 deployments to 25.1.1.2 or later; the 22.8 branch reaches end of life on January 31, 2027.
Compromise assessment and recovery
Update affected appliances immediately and investigate signs of prior compromise. If compromise is suspected, follow Ivanti’s recovery procedures and assess potentially exposed credentials. Patching and successful remediation verification do not establish that an appliance was never compromised or that previously stolen credentials are secure.
Timeline
- October 3, 2026: Earliest exploitation identified in Volexity’s investigation.
- October 5, 2026: Volexity began investigating suspicious activity associated with a compromised ICS appliance.
- October 13, 2026: Volexity published its analysis of the exploit chain.
- October 13, 2026: Ivanti published its security advisory, identifying available updates and confirming exploitation in the wild.
- October 13, 2026: CISA added CVE-2026-104935 to its Known Exploited Vulnerabilities catalog.
- October 15, 2026: Horizon3 released the NodeZero Rapid Response test for CVE-2026-104935.
