CISA warns active exploitation of Ivanti Connect Secure by CVE-2026-104935

Ivanti Connect Secure (ICS), the VPN / SSL platform widely used for remote access, is being actively exploited in nature by a vulnerability of no authentication that allows remote execution of commands. The failure, identified as CVE-2026-104935 and with a CVSS score of 8.6, was noted by the U.S. Infrastructure and Cybersecurity Security Agency. The United States (CISA), which also included it in its Known Exploited Vulnerables (KEV) catalogue - which forces US federal agencies to correct it before October 16, 2026 - and urged operators to update their Ivanti devices to the latest version. The versions affected by the decision are 25.1.1.1 and above, 25.1.2.2 and above, and 22.8R2.4 and above; Ivanti further warns that branch 22.8 will reach the end of its life on 31 January 2027.

In a manner confirmed by public sources, multiple response teams have observed attempts at exploitation. Volexity reported exploitative activity since at least October 3, 2026, attributing campaigns operated by an actor who called UTA0576 and which, according to his analysis, combines authentication bypass with an additional vulnerability of escalation of privileges to achieve execution as root without credentials. Regardless of the actor's motivation, Volexity documents post-exploitation consistent with the theft of credentials, the extraction of Active Directory metadata, the deployment of tools for Kerberoast attacks and the search for BitLocker keys. In parallel, the company Previdian recorded 105 attempts at exploitation aimed at its honeypots until 14 October 2026, originating from dozens of different PIs, indicating coordinated campaigns and active testing of remote execution capacity.

What happens technically(confirmed and explained): vulnerability allows a remote attacker to skip the authentication process and reach the application's internal (CGI) handlers. Researchers have observed the abuse of the HTTP X-DSWGI-PATH header to direct requests to an internal handler that accepts files; attackers upload packages that appear to be ZIP but contain Perl scripts. If the remote execution works, these scripts return unique markers that confirm the success of the explosion. In some documented incidents, this initial execution has been joined by climbing vectors to obtain system privileges and perform post-exploitation actions designed to maximize access and persistence.

Who it affects(confirmed): any organisation using Ivanti Connect Secure in the above versions and having the device accessible from unreliable networks is at risk. This includes physical applications, virtual instances and cloud deployments. The risk is particularly critical for infrastructure that exposes remote access to public Internet administration or VPN without additional access controls.

Actual and observed consequences(confirmed and estimated): after the operation, adversaries have managed to steal credentials stored in the application, capture LDAP / AD traffic and deploy post-operation tools that allow search for administrative passwords and recovery of disk keys. Volexity also describes deliberate attempts to delete or modify records and leave the system in a state that makes detection difficult. At the operational level, this can result in access to corporate accounts, lateral movement within internal networks, commitment of critical authentication infrastructures and exfiltration of sensitive data. The campaigns observed so far have focused on performance tests, but the reports indicate that the next phase probably consists of more harmful and targeted payloads.

What is confirmed:: existence of CVE-2026-104935; active exploitation documented since 3 October 2026; inclusion in the KEV catalogue of CISA with the final date of mediation for federal agencies; observations of exploitation tests by Previdian and post-exploitation activity documented by Volexity. What is estimate or still uncertain: the total extent of the commitment in real facilities (how many applications have been completely compromised outside the honeypots), the final identity or operational attribution of all attackers and whether there are mass exfiltration campaigns already in progress beyond published cases.

Specific and prioritized actions to be taken by technical officials today: first, to apply patches. If your deployment can be updated, do so immediately following Ivanti's compatibility and migration guide ( https: / / www.ivanti.com / support / security-advices). CISA offers additional information in its KEV catalog ( https: / / www.cisa.gov / knowledge-exploited-vulnerabilities-catalog), which details time limits and requirements for the public sector.

If you cannot park immediately or need time for a controlled intervention, apply compensatory mitigation: it restricts access to the application to known IP addresses by means of access control lists or perimeter firewalls, move the administration off the public Internet and limit ports through separate management VPNs, implement multifactor authentication for administration access, and deploy IDS / IPS and WAF rules that detect and block requests with anomalous headers (e.g. X-DSCGI-PATH) or unexpected file uploading attempts. Prioritize access log, web records and any file upload that does not correspond to legitimate use.

If you suspect commitment, CISA and the teams that have investigated recommend specific forensic and mediation steps: create a copy of the device's current configuration, perform a factory reset and update to the parched version, or in virtual environments rebuild the instance; restore the configuration from the copy only after confirming that it does not contain malicious objects; reset all passwords (local, administrative, domain) and revoke / reissue certificates and keys; and conduct memory and network analysis to identify signs of illicit execution. Volexity has documented techniques for the cleaning of artifacts by attackers, so containment must be assumed from the perspective that the opponent tries to hide.

Practical detections that security teams can implement: search the entry log with the X-DSCGI-PATH header, examine up charges that have ZIP extensions but contain Perl scripts or other interpreters, detect unexpected Perl or Python processes in applications, review outgoing connections to unknown hosts from the application, and analyze LDAP and Kerberos traffic in search of anomalies and metadata extraction. For additional technical guidance on observed indicators and tactics, see public analysis of incident response companies and research reports on specialized blogs such as Volexity ( https: / / www.volexity.com / blog /).

In short, vulnerability in Ivanti Connect Secure is an active threat that has already been used to validate remote execution and, in documented cases, to steal credentials and carry out advanced post-exploitation actions. The immediate priority is to patch or apply restrictive mitigation and conduct forensic analysis if the equipment has been exposed. Critical infrastructure operators and VPN administrators should consider these measures as urgent: the reaction time can now make the difference between containing a concept test and responding to an intrusion with persistence and exfiltration of data.