ALERT · Actively exploited. Last updated 28 October 2026. See the Alert Tracker
Companion hunt: Hunt: Ivanti Connect Secure X-DSCGI-PATH mismatch.
If you run Ivanti Connect Secure on 22.8R2.4 / 25.1.1.1 / 25.1.2.2 or earlier trains, patch now. Credential theft and data exfiltration have already been observed in the wild.
What it is
CVE-2026-104935 (opens in a new tab) is an authentication-bypass-by-spoofing flaw (CWE-290) that lets a remote unauthenticated attacker execute arbitrary commands. Vendor CVSS 3.1 is 8.6 High. Volexity (opens in a new tab) documents a zero-day chain: auth bypass via welcome.cgi with X-DSCGI-PATH into protected CGIs, a raceable write in wu.cgi, then a separate privilege-escalation step (fix due later). Commands rode the HTTPS channel; no durable webshell was required.
Who is affected
Ivanti Connect Secure 25.1.1.1 and prior, 25.1.2.2 and prior, and 22.8R2.4 and prior. Fixed builds: 25.1.1.2, 25.1.3.0, 25.1.3.1, and 22.8R2.5 (Ivanti October 2026 update). Version 22.8 reaches end of life on 31 January 2027; prefer a 25.x line where you can.
Exploitation status
CISA added the CVE to KEV on 13 October 2026 (federal agencies: KEV remediation overdue since 16 October; ransomware Unknown; forensic triage Yes). Volexity tracks the operator as UTA0576 and saw Active Directory / LAPS / BitLocker secret theft after root. FIRST EPSS (27 October): about 0.868 (99.7th percentile).
Fix and mitigation
Upgrade to a fixed build per Ivanti’s advisory (opens in a new tab). Do not rely on the Integrity Checker alone — CISA and Volexity note in-memory / restored-state tradecraft can leave it clean. If compromise is suspected: config backup → factory reset (or rebuild the VA) → restore config → rotate all passwords, certificates, API keys and licence credentials. Monitor mismatches between request URL and X-DSCGI-PATH on /dana-na/auth/url_default/welcome.cgi.
How to hunt
Look for bursts to welcome.cgi with X-DSCGI-PATH pointing at wu.cgi or /home/runtime/tmp/; unexpected files under /tmp/; and packet-capture tooling under hidden paths such as /data/.icscap/. Draft notes: hunts/ in this pack.
Sources
- CISA — Ivanti Connect Secure CVE-2026-104935 (opens in a new tab) (13 October 2026)
- Ivanti Security Advisory CVE-2026-104935 (opens in a new tab)
- Ivanti — October 2026 Patch Tuesday (opens in a new tab) (fixed builds)
- Volexity — chained ICS zero-days (opens in a new tab) (13 October 2026)
- CISA KEV (opens in a new tab) (dateAdded 2026-10-13, dueDate 2026-10-16 — overdue for federal agencies)
- NVD CVE-2026-104935 (opens in a new tab)
Follow Cyber-Threat.net RSSFeedly (opens in a new tab)X (opens in a new tab)Bluesky (opens in a new tab)LinkedIn (opens in a new tab)