Summary

CVE-2026-104935 is an authentication bypass by spoofing vulnerability in Ivanti Connect Secure (ICS) that allows a remote, unauthenticated attacker to execute arbitrary commands. It is listed in the CISA Known Exploited Vulnerabilities (KEV) Catalog, and Volexity reports recent exploitation by a previously unknown threat actor they track as UTA0576. Fixed ICS releases are now available.

Affected Systems and/or Applications

| Product | Impacted Versions | Fixed Versions |

|----------|------------------|----------------|

| Ivanti Connect Secure (ICS) | 25.1.1.1 and prior
25.1.2.2 and prior
22.8R2.4 and prior | 25.1.1.2
25.1.3.0, 25.1.3.1
22.8R2.5 |

Technical Details

Vulnerability Mechanism

• Weakness: CWE-290, Authentication Bypass by Spoofing.
• A remote unauthenticated attacker can bypass authentication and execute arbitrary commands on the appliance.

Observed Exploitation Path

Per Volexity:

• Exploitation was observed between 2026-10-03 and 2026-10-07.
• The activity is attributed to UTA0576, a previously unknown actor.
• Requests were sent to /dana-na/auth/url_default/welcome.cgi carrying the header:

X-DSCGI-PATH: /home/webserver/htdocs/dana/fb/smb/wu.cgi  

• Post-exploitation artifacts may be present in /tmp/; disk-based tooling may not detect the compromise, so memory forensics is recommended.
• Observed attacker infrastructure:‍


108.165.147[.]64  

(Evoxt VPS running OpenVPN)

Mitigation

Immediate Actions for Self-Hosted Instances

Limit Exposure

• Identify all ICS appliances and determine which are reachable from the internet.
• Prioritize exposed, unpatched instances.
• Ivanti's security advisory lists no known workaround at this time.

Patch / Upgrade

Upgrade to a fixed release:

• 25.1.1.1 and prior → Update to 25.1.1.2
• 25.1.2.2 and prior → Update to 25.1.3.0 or 25.1.3.1
• 22.8R2.4 and prior → Update to 22.8R2.5

What the Cyber Fusion Center Is Doing

The CFC is monitoring the situation and analyzing the case to identify potential threat-hunting campaigns. This advisory will be updated if required.

References

• Volexity: A Series of Unauthenticated Events: Chained Exploitation of Ivanti Connect Secure Zero-Days

https://www.volexity.com/blog/2026/10/13/a-series-of-unauthenticated-events-chained-exploitation-of-ivanti-connect-secure-zero-days/

• Ivanti: Security Advisory - Ivanti Connect Secure (CVE-2026-104935)

https://hub.ivanti.com/s/article/Security-Advisory-Ivanti-Connect-Secure-CVE-2026-104935

• CISA KEV Catalog:

https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-104935