Full Report
Vendor promises fix for separate privilege-escalation flaw in the coming weeks
Analysis Summary
# Vulnerability: Ivanti Connect Secure Authentication Bypass and RCE
## CVE Details
- **CVE ID:** CVE-2026-104935
- **CVSS Score:** 8.6 (High)
- **CWE:** Authentication Bypass / Command Injection (chained)
## Affected Systems
- **Products:** Ivanti Connect Secure (ICS)
- **Versions:**
- 25.1.1.1 and earlier
- 25.1.2.2 and earlier
- 22.8R2.4 and earlier
- **Configurations:** Default configurations are likely vulnerable; however, the vulnerability specifically impacts the appliance interface accessible via the network.
## Vulnerability Description
CVE-2026-104935 is an authentication bypass vulnerability that, when successfully exploited, allows a remote, unauthenticated attacker to execute arbitrary commands on the Ivanti Connect Secure appliance. While Ivanti issued a single CVE, researchers at Volexity describe an attack chain consisting of multiple stages (Authentication Bypass and Remote Code Execution). A separate, third vulnerability involving privilege escalation within the chain remains unpatched.
## Exploitation
- **Status:** Exploited in the wild (Zero-day) by threat actor UTA0576.
- **Complexity:** Low (Targeted attacks observed using automated scripts).
- **Attack Vector:** Network (Remote).
## Impact
- **Confidentiality:** High (Credential theft and data exfiltration observed).
- **Integrity:** High (Log tampering and command execution).
- **Availability:** High (Potential for full system compromise).
## Remediation
### Patches
Ivanti has released updates for the following branches:
- **Version 25.x:** Update to 25.1.3.0 or later.
- **Backported fixes:** Ensure the latest hotfix/version is applied for 22.x branches as per vendor guidance.
### Workarounds
- No specific configuration-based workaround was provided in the report. Immediate patching is the primary recommendation.
- A fix for the secondary privilege-escalation flaw is expected "in the coming weeks."
## Detection
- **Indicators of Compromise:** Volexity reports observed post-exploitation activity including network reconnaissance, credential harvesting, and log tampering. Notably, attackers did not use web shells but used the exploit channel to run repeated commands.
- **Detection Methods and Tools:**
- Run the **Ivanti Integrity Checker Tool** immediately and regularly to identify unauthorized file system changes.
- Monitor for "highly specific scripts using hardcoded credentials."
- Review logs for unusual command execution from unauthenticated sources.
## References
- Ivanti Advisory: hxxps[://]hub[.]ivanti[.]com/s/article/Security-Advisory-Ivanti-Connect-Secure-CVE-2026-104935?language=en_US
- Volexity Research: hxxps[://]www[.]volexity[.]com/blog/2026/10/13/a-series-of-unauthenticated-events-chained-exploitation-of-ivanti-connect-secure-zero-days/