Actively Exploited Zero

Ivanti Connect Secure is an enterprise remote access solution used by organisations to provide secure access to internal networks and corporate resources. A compromise of these appliances can have significant consequences for the security of the organisation's IT infrastructure.

Successful exploitation of CVE-2026-104935 may allow attackers to gain control of the appliance and use it as a foothold for further malicious activity. Volexity observed attackers attempting to steal LDAP credentials, retrieve LAPS passwords and BitLocker recovery keys, intercept LDAP traffic and conduct password-spraying attacks against Active Directory. Such activities could facilitate lateral movement, compromise additional systems and expose sensitive organisational data.

The vulnerability is exploited in the wild, according to Ivanti and CISA. Given the possibility of exploitation without authentication or user interaction, organisations operating affected appliances should treat this vulnerability as an urgent security concern and prioritise remediation.

CVE-2026-104935 is an authentication bypass by spoofing vulnerability that allows a remote, unauthenticated attacker to bypass authentication and execute arbitrary commands on a vulnerable appliance. Successful exploitation requires no prior privileges or user interaction.

According to Volexity, the attack chain observed in October 2026 combined three vulnerabilities to achieve unauthenticated root-level code execution:

Authentication bypass: Requests to welcome.cgi could be routed to arbitrary CGI files, including files normally protected by authentication.

Remote code execution: A file-write vulnerability involving wu.cgi allowed the attacker to execute commands as the appliance's cgi-server user.

Privilege escalation: A separate vulnerability involving the privileged dsinvoked service and the DSCache configuration store enabled escalation to root privileges.

The authentication bypass and RCE vulnerabilities are tracked together as CVE-2026-104935 by Ivanti and patches are available, while a fix for the separate privilege-escalation vulnerability is still pending.

Volexity attributes the observed activity to a threat actor tracked as UTA0576. The investigation found that the attacker repeatedly executed the exploit chain to run commands and return results through HTTPS responses, rather than deploying a persistent web shell or a separate command-and-control channel.

Following exploitation, the attacker attempted to extract stored LDAP credentials, query Active Directory for LAPS passwords and BitLocker recovery information, inspect authentication logs, capture LDAP traffic and conduct password-spraying attacks. The attacker also modified audit logs and restored in-memory changes to conceal activity.

The Centre for Cybersecurity Belgium strongly recommends installing updates for vulnerable devices with the highest priority after thorough testing.

Further Ivanti notes that even if versions 22.7.14 and lower are not affected by this vulnerability, both release lines 22.7.X and 22.8.X reach End-of-Life on the 31st of January 2027 and customers should plan to migrate to the latest 25.1.X release line versions.

For customers using versions 22.8R2.4 and prior that cannot immediately migrate to the newer release lines can temporarily patch to version 22.8R2.5 that fixes the vulnerability.

The CCB recommends organisations upscale monitoring and detection capabilities to identify any related suspicious activity and ensure a swift response in case of an intrusion.

Based on Volexity's investigation, organisations should prioritise the following detection and investigation measures:

1. Monitor HTTP requests and authentication bypass attempts

Look for unusually large numbers of requests to /dana-na/auth/url_default/welcome.cgi .

Inspect requests containing the X-DSCGI-PATH HTTP header, particularly when its value does not correspond to the requested URL path.

Investigate header values referencing unexpected CGI files or temporary paths, including / /webserver/htdocs/dana/fb/smb/wu.cgi and files under / /runtime/tmp/ .

Correlate suspicious requests with appliance logs, source IP addresses and subsequent administrative or network activity.

2. Inspect the appliance for suspicious files and processes

Investigate unexpected files in /tmp/ and /data/.icscap/ , including scripts, compressed or encoded output files and packet-capture data.

Look for suspicious processes or executables operating from hidden directories, including renamed packet-capture utilities.

Review evidence of unexpected Python or Perl execution and unusual access to appliance configuration files.

Where available, investigate suspicious files, process activity and open file descriptors using forensic tools.

3. Review logs and privileged activity

Examine available authentication, debugging and Linux audit logs for unexpected access, command execution, privilege escalation or unexplained gaps.

Pay particular attention to / /runtime/ dlogs / debuglog and /var / log / audit / audit.log .

Look for signs of log truncation or modification, temporary payload execution and restoration of altered configuration data.

Preserve available logs and other evidence before attempting remediation, as attackers may delete or modify forensic artefacts.

4. Investigate potential lateral movement and credential theft

Review LDAP traffic, particularly connections over TCP port 389, for unexpected queries, credential exposure or suspicious data transfers.

Investigate unusual LDAP searches for LAPS credentials, BitLocker recovery information, password-bearing attributes and other sensitive Active Directory data.

Look for password-spraying activity, suspicious Kerberos operations, unexpected DNS queries and reconnaissance originating from the appliance.

Assess whether credentials or secrets stored on or accessible through the appliance may have been exposed. Rotate affected credentials and secrets, including service-account credentials, where compromise is suspected.

5. Do not rely solely on the Integrity Checker Tool

Volexity found that the attacker modified library code in memory and restored configuration data and other system state to conceal activity. The Ivanti Integrity Checker Tool may therefore fail to identify this attack chain.

A clean integrity-check result should not be considered proof that an appliance is not compromised. If exploitation is suspected, preserve evidence and perform appropriate disk, memory and network forensics.

Volexity also identified the IP address 108.165.147[.]64 in the investigated incident. Organisations may use this as a supplementary indicator for retrospective searches, but should not rely on it alone to determine whether a compromise occurred.

If compromise is confirmed or strongly suspected, follow Ivanti's recovery guidance, assess potential access to connected systems and investigate whether credentials or sensitive data were exposed.

In case of an intrusion, you can report an incident via

While patching appliances or software to the newest version may protect against future exploitation, it does not remediate historic compromise.