Affected Systems

Ivanti Connect Secure VPN appliances before version 25.1.3.0 are affected. Versions 22.7R2.14 and earlier are not affected. Versions 22.8R2.5, 25.1.3.0, and 25.1.3.1 are patched for two of three flaws. The privilege escalation vulnerability remains unpatched across all versions.

Exploitation Status

Active exploitation confirmed in the wild since October 3, 2026. Ivanti reports "limited exploitation." Volexity observed attacker UTA0576 exploiting a fully patched appliance running version 22.8R2.4. CISA marks exploitation as "active" with "total" technical impact.

Business Impact

Attackers achieve unauthenticated root command execution by chaining CVE-2026-104935 (authentication bypass + RCE, CVSS 8.6) with an unpatched privilege escalation flaw. Observed post-exploitation includes credential theft (LDAP domain credentials), Active Directory enumeration, and password spraying. Ivanti's Integrity Checker Tool cannot detect this attack because the exploit operates in memory and restores altered configuration data. Forensic investigation including network and memory analysis is required to confirm compromise. No temporary workaround is available, and it is unclear whether upgrading removes existing attacker access.

Urgency

🔴 Immediate

Recommended Actions

  • Upgrade Ivanti Connect Secure to version 22.8R2.5, 25.1.3.0, or 25.1.3.1 immediately to patch CVE-2026-104935 (authentication bypass and RCE).
  • Monitor for indicators of compromise: excessive requests to /dana-na/auth/url_default/welcome.cgi, HTTP header X-DSCGI-PATH with mismatched URL path values, presence of /data/.icscap/ directory, and connections from IP 108.165.147.64.
  • Conduct forensic investigation including network traffic analysis and memory forensics on all Connect Secure appliances to detect in-memory exploitation that bypasses Ivanti Integrity Checker Tool.
  • Reset all credentials stored on Connect Secure appliances and review Active Directory for signs of password spraying or unauthorized access, especially LDAP domain credentials.
  • Plan for immediate deployment of the third patch addressing privilege escalation when Ivanti releases it in coming weeks, as the residual risk from this unpatched flaw is currently unknown.