Affected Systems

Ivanti Connect Secure (ICS) versions 25.1.1.1 and prior, 25.1.2.2 and prior, and 22.8R2.4 and prior. All organizations running affected ICS VPN appliances are at risk of unauthenticated remote code execution.

Exploitation Status

Active exploitation confirmed since October 1, 2026. CISA added CVE-2026-104935 to KEV catalog. Threat actor UTA0576 observed exploiting the flaw for credential theft and data exfiltration. Honeypots logged 105 exploit attempts from 50 unique IPs. Exploitation is simple—single HTTP request with crafted X-DSCGI-PATH header bypasses authentication.

Business Impact

Remote unauthenticated attackers can execute arbitrary commands with root privileges on ICS appliances. Observed post-exploitation includes credential harvesting from VPN appliance, Active Directory metadata exfiltration, Kerberoast attacks, LDAP packet capture, and extraction of administrator passwords and BitLocker recovery keys. Threat actors evade Ivanti Integrity Checker Tool by tampering with logs and re-exploiting without persistent malware. FCEB agencies must patch by October 16, 2026. Version 22.8 reaches EOL January 31, 2027.

Urgency

đź”´ Immediate

Recommended Actions

  • Immediately upgrade all Ivanti Connect Secure appliances to the latest patched version per Ivanti's Connect Secure Upgrade and Migration Compatibility Guide.
  • Conduct network and memory forensics to detect exploitation; search logs and network traffic for inbound requests containing 'X-DSCGI-PATH' header.
  • If compromise is detected: factory reset appliance, rebuild virtual instances, upgrade to latest version, then restore configuration from backup.
  • Reset all passwords (domain, administrator, local accounts) and revoke/reissue all stored certificates, API keys, and license server credentials.
  • Prioritize migration from version 22.8 before January 31, 2027 EOL date to maintain vendor support.

---

# Geopolitical Context

Geopolitical Context

The advisory reflects ongoing U.S. government efforts to defend critical infrastructure against opportunistic cyber threats. Ivanti Connect Secure appliances serve as VPN gateways for enterprise and government networks, making them high-value targets for both espionage-focused and criminally motivated actors. The vulnerability's inclusion in CISA's Known Exploited Vulnerabilities catalog signals federal concern over potential cascading impacts to agencies and critical sectors. The rapid exploitation timeline—beginning October 1, 2026, before public disclosure—suggests either insider knowledge or sophisticated reconnaissance capabilities among threat actors. Volexity's attribution to UTA0576, assessed as criminally motivated, indicates this incident may represent financially driven intrusion rather than state-sponsored intelligence collection, though the credential harvesting and Active Directory targeting could enable follow-on operations by other actors. The lack of clear state nexus distinguishes this event from previous Ivanti exploitation campaigns linked to espionage groups.

State Actor Alignment

No state actor attribution has been provided by CISA, Volexity, or other reporting entities. Volexity assesses the identified threat actor UTA0576 as driven by criminal motives rather than espionage objectives. The pre-disclosure exploitation window and sophisticated tradecraft—including selective log tampering and fileless execution—demonstrate advanced capabilities, but current evidence does not link activity to nation-state operations. The vulnerability's appeal to ransomware groups, as noted by watchTowr, suggests potential for future criminal ecosystem adoption. Federal agencies are mandated to patch by October 16, 2026, under CISA's binding operational directive framework, reflecting U.S. government prioritization of this threat independent of attribution.

Business Impacty pro region

The vulnerability poses acute risk to U.S. federal networks and critical infrastructure sectors reliant on Ivanti Connect Secure for remote access. CISA's mandatory patching deadline for Federal Civilian Executive Branch agencies underscores domestic exposure. Globally, organizations in allied nations using ICS appliances face similar risk, particularly in Europe where VPN infrastructure supports cross-border enterprise operations and government services. The honeypot data showing exploit attempts originating from Singapore and U.S.-based IP addresses suggests either geographically distributed threat actor infrastructure or use of compromised systems and VPN exit nodes to obscure origin. The credential theft and Active Directory enumeration capabilities enable lateral movement into corporate and government networks, potentially affecting multinational organizations with European operations. The vulnerability's addition to the KEV catalog may prompt coordinated patching guidance from European cybersecurity agencies (ENISA, national CERTs) and Five Eyes partners.

Forecast

If exploitation continues to expand beyond targeted reconnaissance to mass scanning and payload deployment, organizations may face widespread credential compromise and network intrusion within days. The simplicity of the authentication bypass—requiring only a crafted HTTP header—lowers the barrier for less sophisticated actors to develop exploits, likely accelerating adoption across criminal forums. If ransomware groups integrate CVE-2026-104935 into initial access playbooks, critical infrastructure sectors may experience increased intrusion attempts through November 2026, particularly targeting organizations slow to patch or running end-of-life versions. Should state-aligned actors adopt the exploit, the credential harvesting and domain enumeration capabilities could enable espionage campaigns against government and defense contractors. Organizations that delay patching beyond CISA's October 16 deadline face elevated risk of compromise, with forensic investigation costs and potential regulatory scrutiny likely to follow detected breaches.