What happened

On October 13, 2026, Ivanti disclosed CVE-2026-104935 in Connect Secure, its SSL VPN, and said it is "aware of limited exploitation in the wild." Ivanti scores it CVSS 3.1 8.6 and classifies it as authentication bypass by spoofing (CWE-290). According to the CVE record, it "allows a remote unauthenticated attacker to execute arbitrary commands." No special configuration is required. Ivanti told reporters it had found part of the flaw through its own security program and was backporting a fix when exploitation began. CISA added the CVE to the KEV catalog the same day and published an alert urging immediate patching.

Volexity, credited with the discovery, saw the attacks starting on October 3. It described a chain against a customer appliance running 22.8R2.4, which was "fully patched" at the time. The attacker sent requests to the public sign-in endpoint, welcome.cgi, with an X-DSCGI-PATH header naming a script that should not be reachable. The URL decided whether the request was allowed, and the header decided which script ran. Through that, the attacker uploaded and ran a Perl script, then used a separate privilege escalation to become root. Volexity says Ivanti will fix that last step "in a future release in the coming weeks," and it has no CVE yet. The actor, which Volexity tracks as UTA0576, stole LDAP and domain credentials, LAPS passwords and BitLocker recovery keys, tampered with logs, and deployed no malware or web shell. Volexity assesses with low confidence that the motive is criminal rather than espionage. It has not tied the actor to a known group.

Wider attacks have started. Shadowserver counts over 5,500 internet-exposed Connect Secure instances, BleepingComputer reported, and The Hacker News reported one honeypot operator logging 105 exploitation attempts from 50 IP addresses by October 14. No public proof of concept has been reported.

Why it matters if you run public infrastructure

Connect Secure is the front door for remote access, and it has been a favorite target for years. This case shows why patch status alone is not enough. The victim was on the current release, and the attacker went straight for what a VPN appliance holds: directory credentials, local admin passwords and disk encryption keys. Because the commands ran in memory and no web shell was left behind, CISA warns that Ivanti's Integrity Checker Tool "may not detect evidence of exploitation," and Volexity says it found no modifications for the tool to catch. Connect Secure 22.8 also reaches end of life on January 31, 2027, per CISA, so the next upgrade decision is coming either way.

What to check this week

  1. Find every Connect Secure you expose, including old Pulse Secure appliances, secondary gateways and lab boxes. From outside, the giveaway is the /dana-na/auth/url_default/welcome.cgi sign-in page.
  2. Check the version in the admin console under Maintenance, System, Platform. Affected: 22.8R2.4 and earlier 22.8 builds, 25.1.1.1 and earlier on ISA6000/ISA8000, and 25.1.2.2 and earlier on ISA4500/6500/8500. 22.7R2.14 and earlier are not affected.
  3. Upgrade now to 22.8R2.5, 25.1.1.2, or 25.1.3.0/25.1.3.1. Ivanti offers no workaround.
  4. Hunt in the logs, not just the Integrity Checker. Volexity's indicators include bursts of requests to welcome.cgi, X-DSCGI-PATH headers pointing at other scripts (such as /home/webserver/htdocs/dana/fb/smb/wu.cgi), requests where the URL and the header disagree, unexpected files in /tmp/ or /data/.icscap/dsstatmond, and contact with 108.165.147[.]64. The full list is on Volexity's GitHub.
  5. If you suspect compromise, follow CISA's recovery steps. Back up the configuration, factory reset and upgrade (rebuild cloud or virtual instances), then restore the configuration. Reset domain, admin and local passwords, revoke and reissue certificates stored on the appliance, and reset API keys and license server credentials. Given what this actor took, also rotate LAPS passwords and BitLocker recovery keys for machines whose secrets the appliance could reach.

How Attack Surface Scan covers this

Attack Surface Scan recognizes the Ivanti Connect Secure (Pulse Secure) sign-in page on hosts under your verified domains, including hosts found through certificate transparency logs. The appliance does not show its version to anonymous visitors, so we cannot confirm the exact release from outside. It is one of the edge products where we raise a potential match for KEV-listed CVEs like this one, capped at medium severity and tagged potential, with instructions for checking the real version. We do not send exploit payloads or attempt to trigger the flaw, and we cannot see whether an appliance was compromised. See Vulnerability matching for the details.

Sources