CVE-2026-104935

What is Ivanti Connect Secure?

Ivanti Connect Secure (ICS), formerly Pulse Connect Secure and before that Juniper SA, is an SSL VPN appliance that terminates remote-access sessions for employees and contractors. It sits at the network edge with its web interface exposed to the internet, authenticates users against AD, LDAP, or SAML, and then grants them routed or clientless access to internal resources. That position makes it a standing target: a flaw in the pre-authentication web surface converts directly into a foothold inside the perimeter, with the appliance's own credentials and session material available on the way in. Shadowserver tracks more than 5,500 internet-exposed ICS instances, and CISA has now flagged 36 Ivanti vulnerabilities as exploited since November 2021.

Overview

CVE-2026-104935 is an authentication bypass by spoofing in the ICS web server, rated 8.6 High (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L). A remote attacker with no credentials can reach CGI handlers that are supposed to require a logged-in session, and from there execute arbitrary commands on the appliance.

Ivanti disclosed the flaw on 2026-10-13 and acknowledged "limited exploitation in the wild" affecting a small number of customers. It was a true zero-day: Volexity observed exploitation from at least 2026-10-03, and the honeypot operator Defused reported the first attempts on 2026-10-01. Ivanti has said that part of the underlying problem was already corrected in release 25.1.3.0 in July 2026, and that exploitation occurred while the fix was still being backported to the other supported branches, so customers on 25.1.2.x and 22.8R2.x remained exposed.

The authentication bypass is only one link in the chain Volexity documented. The attacker combined it with a file-upload race condition to achieve code execution, and then with a separate privilege escalation flaw to reach root on fully patched devices. That privilege escalation issue has no CVE identifier yet and was still unpatched at disclosure, with Ivanti saying a fix would follow in the coming weeks.

Affected Versions

Ivanti's wording is "and prior" within each applicable code line. Note that one secondary advisory rendered the same ranges as "all prior to" the fixed builds, which is narrower; follow the vendor advisory if the two readings would change your decision.

Technical Details

The CWE is CWE-290, authentication bypass by spoofing: the system decides who you are, or what you are allowed to reach, from input the attacker controls. Here the access check and the dispatch decision use different inputs. The endpoint /dana-na/auth/url_default/welcome.cgi is deliberately unauthenticated, so the URL passes the access check. The ICS web server then consults the attacker-supplied X-DSCGI-PATH header to decide which CGI binary actually handles the request. Setting that header to /home/webserver/htdocs/dana/fb/smb/wu.cgi routes an unauthenticated request into a post-authentication handler.

Code execution comes from a race in wu.cgi's upload handler. The uploaded file is written to disk first, then checked for ZIP validity and deleted if it fails. During that window the file exists at a predictable path, /home/runtime/tmp/<MD5 of filename>. Parallel requests that point X-DSCGI-PATH at that path execute the uploaded script before cleanup runs. No authentication, no user interaction, and low complexity, though the race means an attacker fires a burst of requests rather than a single one.

Discovery

Volexity discovered and reported the vulnerability after investigating suspicious activity on a Network Security Monitoring customer's network starting 2026-10-05, and published its analysis the same day as Ivanti's advisory. Defused independently corroborated the exploitation attempts in its honeypot data. Ivanti credits Volexity in the advisory; Rapid7 and runZero published detection and asset-identification guidance alongside the disclosure.

Exploitation Context

Volexity attributes the activity to UTA0576, a previously unknown actor it assesses with low confidence to be criminally rather than espionage motivated. The tradecraft is notable for what is absent: no backdoor and no web shell were planted. The attacker re-exploited the appliance for each command, which leaves far less on disk, and tampered with logs to cover its activity. Ivanti's Integrity Checker Tool did not detect the intrusion.

Post-exploitation tooling observed on compromised networks included a Kerberos ticket-extraction script with Kerberoast functionality (mk.py, rr.py), an LDAP tool that hunted for LAPS passwords and BitLocker recovery keys (ml.py, rq5.py), a credential harvester that parsed packet captures (h.py), a password-spraying helper (sp_run.py), and a renamed copy of tcpdump masquerading as dsstatmond. The goal was clearly credential collection and lateral movement off the VPN appliance into the domain.

Ivanti describes the victim count as limited and no public figure has been published. Exposure counts for the vulnerable population are likewise unavailable; the 5,500-plus internet-facing ICS instances Shadowserver tracks include patched systems and honeypots.

Remediation

1. Upgrade immediately, outside the normal patch cycle: 25.1.1.2, 25.1.3.0 or 25.1.3.1, or 22.8R2.5 depending on your code line. Appliances on 22.7R2.14 and earlier are not affected.
2. Assume the patch is not sufficient on its own. Ivanti says reliable indicators of compromise are not yet available, and Volexity confirmed the Integrity Checker Tool missed this activity, so treat a previously exposed appliance as suspect until investigated.
3. Hunt in web logs for high volumes of requests to welcome.cgi and, more specifically, for requests where the URL path and the X-DSCGI-PATH header disagree. Check /home/runtime/tmp/ and /tmp/ for leftover upload artifacts.
4. Perform network and memory forensics rather than relying on appliance self-checks, and review NetFlow or firewall logs for lateral movement originating from the VPN appliance toward domain controllers and file servers.
5. If compromise is suspected, follow Ivanti's factory-reset and recovery procedure, then rotate everything the appliance held: local admin credentials, service accounts, AD integration credentials, API keys, and certificates. Treat LAPS passwords and BitLocker recovery keys as exposed given the observed tooling.
6. Restrict management interface reachability and place the appliance behind rate limiting or a WAF rule that rejects client-supplied X-DSCGI-PATH headers as an interim control.
7. Watch for Ivanti's follow-up fix for the unpatched privilege escalation flaw used in the same chain, which was still outstanding at disclosure.
8. Federal civilian agencies must remediate by 2026-10-16 under BOD 26-04 and complete the forensic triage the directive requires.