Full Report
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Tuesday urged organizations to take steps to immediately update their Ivanti Connect Secure (ICS) appliances and deployments to the latest version following the disclosure of an actively exploited vulnerability. The security flaw, tracked as CVE-2026-104935 (CVSS score: 8.6), is a case of authentication bypass impacting ICS
Analysis Summary
# Vulnerability: Ivanti Connect Secure Authentication Bypass and RCE
## CVE Details
- **CVE ID:** CVE-2026-104935
- **CVSS Score:** 8.6 (High)
- **CWE:** Authentication Bypass (Specific CWE not listed, but functionally leads to Command Injection)
## Affected Systems
- **Products:** Ivanti Connect Secure (ICS) appliances (formerly Pulse Connect Secure)
- **Versions:**
- 25.1.1.1 and prior
- 25.1.2.2 and prior
- 22.8R2.4 and prior
- **Configurations:** All active deployments of the affected versions; note that version 22.8 reaches End-of-Life (EOL) on January 31, 2027.
## Vulnerability Description
CVE-2026-104935 is an authentication bypass vulnerability that allows a remote, unauthenticated attacker to reach an internal CGI handler. By manipulating the `X-DSCGI-PATH` header, attackers can upload malicious Perl scripts (disguised as ZIP files) to the appliance. This flaw enables the execution of arbitrary commands at the system level.
## Exploitation
- **Status:** **Exploited in the wild.** CISA has added this to the KEV catalog. Honeypots have logged over 100 attempts, and threat actor UTA0576 has been observed chaining this with privilege escalation for root access.
- **Complexity:** Low (Targeting specific headers to bypass auth)
- **Attack Vector:** Network (Remote)
## Impact
- **Confidentiality:** High (Credential theft, AD metadata exfiltration, and discovery of BitLocker keys)
- **Integrity:** High (Ability to modify logs, execute arbitrary scripts, and alter system state)
- **Availability:** High (Potential for full system takeover and disruption)
## Remediation
### Patches
- **Immediate Action:** Upgrade to the latest available version of Ivanti Connect Secure.
- **Guidance:** Refer to Ivanti’s "Connect Secure Upgrade and Migration Compatibility Guide" for specific version paths.
### Workarounds
- No specific temporary configuration workaround was provided in the article; **immediate patching** or rebuilding of the instance is the primary recommendation.
## Detection
- **Indicators of Compromise (IoCs):**
- **Observed IPs:** 216.73.160[.]59, 216.73.160[.]61, 216.73.160[.]210, 45.8.19[.]111.
- **Header Activity:** Unusual traffic involving the `X-DSCGI-PATH` HTTP header.
- **Artifacts:** Presence of Perl scripts disguised as ZIP files in temporary directories.
- **Detection Methods:**
- Conduct network and memory forensics for evidence of unauthorized command execution.
- Monitor for LDAP packet captures or unauthorized Kerberos tool execution (e.g., Kerberoasting).
- **Incident Response:** If compromise is suspected, perform a factory reset, upgrade the firmware, restore configuration from a known-good backup, and rotate all credentials/certificates.
## References
- CISA KEV Catalog: hxxps://www.cisa[.]gov/known-exploited-vulnerabilities-catalog
- Ivanti Advisory/Upgrade Guide: hxxps://hub.ivanti[.]com/s/article/Ivanti-Connect-Secure-25-x-Upgrade-and-Migration-Compatibility-Guide
- Previdian Telemetry: hxxps://previdian[.]com/CVE-2026-104935#telemetry
- Volexity Research: hxxps://www.volexity[.]com (Referenced in article)