KEV catalog · CISA Known Exploited Vulnerabilities
CVE-2026-104935
8.6
3-Day Required
KEV
Automatable
Active Exploitation
Details
VulnerabilityIvanti Connect Secure Authentication Bypass by Spoofing Vulnerability
VendorIvanti
ProductConnect Secure
Date added2026-10-13
Due date2026-10-16
CISA catalogView on CISA KEV catalog
Required actionApply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
CWECWE-290
CVSS vectorCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L
Descriptions
KEV: Ivanti Connect Secure contains an authentication bypass by spoofing vulnerability that allows a remote unauthenticated attacker to execute arbitrary commands.
Compliance SSVC + BOD 26-04
Automatableyes
Technical impacttotal
Exploitation statusactive
3-day qualifyingYes
Public timeline3 days + forensic
Non-public timeline3 days + forensic
Forensic (public)Required
Forensic (non-public)Required
Research metadata
Last researched2026-10-13 15:49 UTC
Wall time0.6s
Searches12
Component defaultyes
Sources
https://hub.ivanti.com/s/article/Security-Advisory-Ivanti-Connect-Secure-CVE-2026-104935
https://www.volexity.com/blog/2026/10/13/a-series-of-unauthenticated-events-chained-exploitation-of-ivanti-connect-secure-zero-days/
https://github.com/volexity/threat-intel/tree/main/2026/2026-10-13%20Ivanti
https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
https://nvd.nist.gov/vuln/detail/CVE-2026-104935
https://www.cisa.gov/known-exploited-vulnerabilities-catalog
https://www.volexity.com/blog/2026/10/13/a-series-of-unauthenticated-events-chained-exploitation-of-ivanti-connect-secure-zero-days/
https://github.com/volexity/threat-intel/tree/main/2026/2026-10-13%20Ivanti
https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
https://nvd.nist.gov/vuln/detail/CVE-2026-104935
https://www.cisa.gov/known-exploited-vulnerabilities-catalog
Hunting hypothesis agent
Hunt WAF and proxy logs (stock access logs drop headers) for hits on /dana-na/auth/url_default/welcome.cgi carrying X-DSCGI-PATH to wu.cgi or /home/runtime/tmp/ — the Connect Secure routing mismatch enabling unauthenticated RCE.
Research details
Componentwelcome.cgi-to-wu.cgi CGI request routing via the X-DSCGI-PATH header in the ICS web server
PreconditionsUnauthenticated remote attacker with HTTP(S) access to the ICS VPN web interface; affected versions are ICS 25.1.1.1 and prior, 25.1.2.2 and prior, and 22.8R2.4 and prior (22.7R2.14 and lower are not affected); no credentials or user interaction needed (CVSS AV:N/AC:L/PR:N/UI:N); fixed in 25.1.1.2, 25.1.3.0/25.1.3.1, and 22.8R2.5. agent
DeliveryHTTP requests to /dana-na/auth/url_default/welcome.cgi carrying an X-DSCGI-PATH header that routes the request to wu.cgi (upload race to /home/runtime/tmp/<MD5(filename)>)
Public PoCno
Exploit notesNo weaponized public PoC found (GitHub repos/code/issues, Nuclei templates, Exploit-DB and Metasploit searched — all empty). Volexity observed a three-bug chain in the wild (UTA0576): auth bypass in welcome.cgi routing requests to arbitrary CGI files via the X-DSCGI-PATH header, RCE racing a Perl upload written to /home/runtime/tmp/<MD5(filename)> before wu.cgi validates the ZIP, then a dsinvoked/DSCache privilege escalation to root (that fix is still pending). Volexity published detection-only artifacts (YARA rules + IOC CSV), not exploit code; the attacker passed commands through the exploit HTTPS channel with no web shell, and the memory-only patch defeats the Ivanti Integrity Checker Tool.
SummaryCVE-2026-104935 is an authentication bypass by spoofing chained with remote code execution in Ivanti Connect Secure, allowing a remote unauthenticated attacker to run arbitrary commands as root (CVSS 8.6, CWE-290). Volexity caught it in the wild as a zero-day chain against fully patched 22.8R2.4 appliances, driving coordinated disclosure; Ivanti patched on 2026-10-13. CISA added it to KEV the same day with a 2026-10-16 due date; the dsinvoked privilege-escalation fix ships in a future release.
Tia coverage
First reported2026-10-13
First exploit report2026-10-13
Exploit report → KEV0 days before the listing
When Tia's reporting first covered this CVE and whether a report claimed exploitation before the KEV listing. Lead-time deltas are measured from the exploitation report only — plain coverage is not exploitation intel. See the story links under Mentioned in for coverage detail.
Mentioned in
Record schema v1.0. Enrichment is research-grade, not a substitute for analyst review.