Ivanti VPN Zero-Day Exploited in Active Attacks

Incident & Breach Response , Network Firewalls, Network Access Control , Security Operations

A commonly used Ivanti VPN has an authentication bypass vulnerability that is being actively exploited in the wild, the vendor disclosed Tuesday.

See Also: Securing Patient Data: Shared Responsibility in Action

Tracked as CVE-2026-104935 , the high-severity zero-day flaw allows unauthenticated attackers to execute arbitrary commands in Ivanti Connect Secure before version 25.1.3. The U.S. Cybersecurity and Infrastructure Security Agency added it to the Known Exploited Vulnerabilities catalog, giving federal agencies a three-day patch window.

The internet-facing remote access product is a frequent target for attackers, including ransomware gangs, said Yordan Ganchev, principal threat intelligence specialist at exposure management firm watchTowr. Although exploitation is reportedly limited to a small number of customers so far, it is likely to escalate into wider attacks, he warned.

CVE-2026-104935 "joins 14 other Ivanti Connect Secure/Pulse Connect Secure vulnerabilities on the CISA KEV list," Ganchev said. "Given the history, we expect exploitation to move incredibly quickly from targeted attacks to indiscriminate mass exploitation" (see: Chinese Espionage Group Targeting Legacy Ivanti VPN Devices ).

The vulnerability was initially discovered by Ivanti's own security team and patched in the July release, the vendor said . Ivanti was backporting the fix to older, supported versions when exploitation occurred.

"The root cause of the vulnerability is incredibly simple, with a single request containing a specially crafted X-DSCGI-PATH header being all that is needed to bypass authentication and access sensitive functionality that otherwise should be restricted," Ganchev said.

An attacker can spoof signals to appear as someone who is logged in and trusted.

"Once past the login check, the attacker can run arbitrary commands on the Ivanti Connect Secure appliance without providing a username, password, or any other credential," watchTowr said . "Ivanti states this bypass uses a path separate from normal authentication, so existing login protections do not stop it."

Digital forensics firm Volexity first detected malicious activity in its customer environment on Oct. 5 and discovered a previously unknown actor, tracked as UTA0576, chaining together three vulnerabilities in an ICS VPN appliance to execute commands with root privileges.

"Volexity discovered that starting on Oct. 3, 2026, UTA0576 repeatedly exploited these vulnerabilities to compromise the ICS VPN appliance and run commands on it," it said.

Two flaws in the zero-day exploit chain are covered under CVE-2026-104935: an authentication bypass in ICS welcome.cgi that allows attackers to access normally protected CGI scripts and a file-write vulnerability in wu.cgi , which handles file uploads.

They are chained with a privilege escalation vulnerability in dsinvoked , an ICS component that performs privileged system operations. Volexity said the flaw allows attackers to exploit the component's trust in DSCache configuration data to execute commands at the root level.

The threat actor targeted Active Directory credentials and secrets, including Local Administrator Password Solution passwords and BitLocker recovery keys, after appliances were compromised, Volexity said. Other post-exploitation actions included deploying a custom Kerberos tool capable of Kerberoast attacks and credential testing, collecting VPN configuration data and password spraying.

Volexity said it is very likely that UTA0576 was preparing for lateral movement and a broader compromise of the victim networks.

UTA0576 also deleted traces of exploitation from Ivanti debug logs and Linux audit logs and passed commands and data exfiltration through the exploit chain's HTTPS requests rather than a separate command-and-control channel. There was no backdoor or web shell deployed to the compromised devices, Volexity said.