2026-10-14: Cybercriminals can take over Ivanti Connect Secure without a password

Ivanti Connect Secure, the VPN gateway many organizations use to give remote users access to internal systems, contains an authentication bypass vulnerability that lets cybercriminals run arbitrary commands without logging in. They do this by sending crafted requests to the portal’s public pre-login page. CVE-2026-104935 carries an 8.6 out of 10 (High) CVSS score, and cybercriminals exploited it as a zero-day before a fix was available.

Read Ivanti’s security advisory (external link).

How the vulnerability works

The entry point is the public pre-login page of the Connect Secure portal, /dana-na/auth/url_default/welcome.cgi. The page trusts the X-DSCGI-PATH header to choose which script to run, while the access check only looks at the URL. That gives an unauthenticated attacker access to any protected CGI script.

The next step uploads a script through wu.cgi and runs it in the short window before wu.cgi deletes it. This is a race condition, but attackers win it by sending a few parallel requests, and no precise timing is needed. Exploitation requires no non-default configuration, optional component, or user interaction. The result is arbitrary code execution as the cgi-server user.

Why this is dangerous

Ivanti says it’s aware of exploitation affecting a limited number of customers. Volexity observed threat actor UTA0576 exploiting the vulnerability as a zero-day from October 3, and it re-ran the full chain for every command it executed.

CISA added CVE-2026-104935 to its KEV Catalog on October 13. It gave federal agencies until October 16 to act. Ransomware use is unknown.

See CISA’s KEV Catalog entry for CVE-2026-104935 (external link).

In the observed attacks, cybercriminals chained the vulnerability with a separate, still unpatched privilege escalation in dsinvoked/DSCache to gain root. That makes the in-the-wild impact full appliance takeover. They then stole LDAP and AD credentials, LAPS passwords, and BitLocker recovery keys.

Ivanti’s Integrity Checker Tool (ICT) won’t show a compromise. The exploit patches libdsplibs.so in memory only, restores DSCache, and deletes debuglog and audit.log entries.

Affected software

The following versions are affected:

• 22.8R2.4 and earlier in the 22.8 line
• 25.1.1.1 and earlier
• 25.1.2.2 and earlier

Version 22.7R2.14 and earlier aren’t affected. Version 22.7 reaches end of life on January 31, 2027.

Mitigation & next steps

Ivanti urges customers to upgrade to:

• 22.8R2.5
• 25.1.1.2
• 25.1.3.0, or later
• Check for the Volexity indicators of compromise
• Follow Ivanti’s recovery steps
• Treat any LDAP or AD service account configured on the appliance as compromised

Version 25.1.2.x is fixed only by moving to 25.1.3.0, which requires the new ISA4500, ISA6500, or ISA8500 platform. Ivanti’s advisory doesn’t list a workaround.

The root privilege escalation used in the observed attacks isn’t fixed yet. Ivanti says the fix will ship in the coming weeks. Patching CVE-2026-104935 breaks the chain at its entry point, so it remains the priority.

Because ICT can’t detect this compromise, exposed appliances need forensic review:

Holm Security’s response

Holm Security will be releasing its test to scan for this vulnerability on October 15:

•  HID-2-1-5418674 - Ivanti Connect Secure Authentication Bypass Vulnerability (CVE-2026-104935)

Scan for specific vulnerabilities

Read how you can include or exclude a specific vulnerability in a scan profile here.