A critical zero-day vulnerability in Ivanti Connect Secure (ICS) — tracked as CVE-2026-104935 and scored 8.6 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L) — is being actively exploited in the wild and can allow unauthenticated remote code execution on affected appliances. Ivanti and CISA report exploitation; organisations operating vulnerable devices should prioritise patching immediately.
Ivanti Connect Secure vulnerability details
CVE-2026-104935 is an authentication-bypass by spoofing vulnerability that permits a remote, unauthenticated attacker to bypass authentication and execute arbitrary commands on a vulnerable appliance with no prior privileges or user interaction. Ivanti tracks the authentication bypass and remote code execution vulnerabilities together as CVE-2026-104935 and has released patches for them; a separate privilege-escalation flaw that was observed in the same attack chain is not yet fixed.
Affected software listed in vendor and advisory material includes Ivanti Connect Secure (ICS) 25.1.1.1 and prior versions, Ivanti Connect Secure (ICS) 25.1.2.2 and prior versions, and Ivanti Connect Secure (ICS) 22.8R2.4 and prior versions. Ivanti also notes that versions 22.7.14 and lower are not affected by this vulnerability but that release lines 22.7.X and 22.8.X reach End-of-Life on 31 January 2027; customers should plan migration to the latest 25.1.X release line. For users on 22.8R2.4 who cannot immediately migrate, Ivanti provides a temporary fix in version 22.8R2.5.
Observed attack chain and attacker activity
Volexity reported that an attacker used a three-stage chain to achieve unauthenticated root-level code execution: an authentication bypass that routed requests to welcome.cgi to arbitrary CGI files (including files normally protected by authentication), a file-write vulnerability involving wu.cgi that allowed execution as the appliance’s cgi-server user, and a separate privilege-escalation vulnerability tied to the dsinvoked service and the DSCache configuration store that enabled escalation to root. Volexity attributes the activity to a threat actor tracked as UTA0576.
In the incidents Volexity investigated, the attacker repeatedly executed the exploit chain to run commands and return results in HTTPS responses rather than deploying a persistent web shell or separate command-and-control channel. After exploitation the attacker attempted to extract stored LDAP credentials, retrieve LAPS passwords and BitLocker recovery keys, intercept LDAP traffic, inspect authentication logs, and conduct password-spraying attacks against Active Directory. The attacker also modified audit logs and restored in-memory changes to conceal activity.
Mitigation: patching and migration
Ivanti has released patches that address the authentication bypass and remote code execution tracked as CVE-2026-104935; organisations should install updates as a priority after appropriate testing. A fix for the separate privilege-escalation vulnerability observed in the attack chain remains pending. The Centre for Cybersecurity Belgium strongly recommends installing updates for vulnerable devices with highest priority. For customers unable to migrate immediately from 22.8R2.4, Ivanti offers 22.8R2.5 as a temporary patch. Organisations on 22.7.X and 22.8.X release lines should plan migration to 25.1.X before the 31 January 2027 End-of-Life date.
Monitoring and detection guidance for Ivanti Connect Secure
The Centre for Cybersecurity Belgium and Volexity recommend that organisations increase monitoring and detection to identify related suspicious activity. Key measures to prioritise include:
1. Monitor HTTP requests and authentication-bypass attempts
– Look for unusually large numbers of requests to /dana-na/auth/url_default/welcome.cgi.
– Inspect requests containing the X-DSCGI-PATH HTTP header, especially when its value does not correspond to the requested URL path. Investigate header values referencing unexpected CGI files or temporary paths, including /home/webserver/htdocs/dana/fb/smb/wu.cgi and files under /home/runtime/tmp/. Correlate suspicious requests with appliance logs, source IP addresses and subsequent administrative or network activity.
2. Inspect the appliance for suspicious files and processes
– Investigate unexpected files in /tmp/ and /data/.icscap/, including scripts, compressed or encoded output files and packet-capture data. Look for suspicious processes or executables operating from hidden directories, including renamed packet-capture utilities. Review evidence of unexpected Python or Perl execution and unusual access to appliance configuration files. Use forensic tools where available to examine files, processes and open file descriptors.
3. Review logs and privileged activity
– Examine authentication, debugging and Linux audit logs for unexpected access, command execution, privilege escalation or unexplained gaps. Pay particular attention to /home/runtime/dlogs/debuglog and /var/log/audit/audit.log. Preserve logs and other evidence before remediation, as attackers may delete or modify forensic artefacts.
4. Investigate potential lateral movement and credential theft
– Review LDAP traffic (TCP port 389) for unexpected queries, credential exposure or suspicious data transfers. Investigate unusual LDAP searches for LAPS credentials, BitLocker recovery information, password-bearing attributes and other sensitive Active Directory data. Look for password-spraying activity, suspicious Kerberos operations, unexpected DNS queries and reconnaissance originating from the appliance. Rotate affected credentials and secrets, including service-account credentials, where compromise is suspected.
5. Do not rely solely on the Integrity Checker Tool
– Volexity found attackers modified library code in memory and restored configuration data to conceal activity; the Ivanti Integrity Checker Tool may therefore fail to identify this attack chain. A clean integrity-check result should not be considered proof that an appliance is uncompromised. Preserve evidence and perform disk, memory and network forensics if exploitation is suspected.
Volexity also identified the IP address 108.165.147[.]64 in the investigated incident; organisations may use this as a supplementary indicator for retrospective searches but should not rely on it alone to determine compromise.
If compromise is confirmed or strongly suspected, follow Ivanti’s recovery guidance, assess potential access to connected systems and investigate whether credentials or sensitive data were exposed. Incidents can be reported to the Centre for Cybersecurity Belgium at https://ccb.belgium.be/en/cert/report-incident. Patching protects against future exploitation but does not remediate historic compromise, so forensic investigation and remediation are required where intrusion is suspected.
