Habla con un experto
PreciosNoticiasHabla con un experto
Volver a la sala de prensa
Amenazas

CISA Urges Immediate Ivanti Connect Secure Patching as CVE-2026-104935 Exploitation Spreads

An actively exploited authentication bypass in Ivanti Connect Secure (CVE-2026-104935) lets unauthenticated attackers run commands on VPN appliances. Here is what happened and what to do now.

4T4Tify Team4Tify
Oct 14, 2026·4 min de lectura
CISA Urges Immediate Ivanti Connect Secure Patching as CVE-2026-104935 Exploitation Spreads

CISA: Patch Ivanti Connect Secure Now — CVE-2026-104935 Is Under Active Attack

Ivanti Connect Secure (ICS) is once again on the front line. CISA has told organisations to update their ICS VPN appliances immediately after an authentication bypass, CVE-2026-104935 (CVSS 8.6), was confirmed as exploited in the wild. Honeypot telemetry shows the scanning wave is already well underway.

What happened

  • The flaw. CVE-2026-104935 lets a remote, unauthenticated attacker bypass authentication and run arbitrary commands on the appliance. Affected builds are ICS 25.1.1.1 and earlier, 25.1.2.2 and earlier, and 22.8R2.4 and earlier.
  • Exploited as a zero-day. CISA says attackers used it to steal credentials and exfiltrate data. The bug is now in the Known Exploited Vulnerabilities (KEV) catalog, and US federal civilian agencies have until 16 October 2026 to patch.
  • Earliest activity: 3 October. Volexity traced the first exploitation to 3 October 2026. It attributes the activity to a newly tracked cluster, UTA0576, which chained the bypass with a separate privilege-escalation bug to get root without authenticating. Volexity assesses the group as financially motivated, not an espionage actor.
  • What the intruders did next. After getting in, the actors harvested credentials stored on the appliance, pulled limited Active Directory metadata, staged Kerberoasting and credential-testing tooling, captured LDAP traffic and ran a Python script that searched for admin passwords and BitLocker recovery keys. They also selectively edited logs and cleaned up artefacts to cover their tracks.
  • Mass probing has started. Previdian counted 105 exploitation attempts against its honeypots by 14 October, from 50 unique IPs geolocated to Singapore and the US. The probes abuse the X-DSCGI-PATH header to reach an internal CGI handler and upload Perl scripts disguised as ZIP files. So far the payloads mostly check whether code execution works and don't yet drop malware. Previdian expects fully weaponised attacks to follow quickly.

Why it matters

An ICS appliance sits at the edge of the network and holds VPN credentials and directory access. Owning one gives an attacker a trusted foothold straight into Active Directory. The post-exploitation behaviour seen here (Kerberoasting, LDAP sniffing, hunting for BitLocker keys) is typical preparation for ransomware or large-scale data theft. Because the actors also tamper with logs, an appliance that looks clean may not be. Also note that the 22.8 branch reaches end-of-life on 31 January 2027, so teams still on it need a migration plan as well as a patch.

What to do

  1. Inventory and patch now. Find every ICS appliance, including cloud and virtual instances, and upgrade to the fixed release. Use Ivanti's Upgrade and Migration Compatibility Guide to pick the right path.
  2. Assume exposure if you were unpatched after 3 October. CISA says confirming a compromise requires network and memory forensics. Don't rely on appliance logs alone.
  3. If you find a compromise, rebuild instead of cleaning in place. Back up the configuration, factory-reset the appliance (or rebuild the virtual instance), upgrade to the latest version, then restore the configuration.
  4. Rotate everything the appliance touched. Reset domain, admin and local account passwords. Revoke and reissue stored certificates. Reset API keys and license-server credentials.
  5. Hunt downstream. Look for Kerberoasting (bursts of RC4 TGS requests), unusual LDAP queries from the VPN appliance's IP, and access to BitLocker recovery attributes in AD.
  6. Watch the edge. Alert on requests carrying the X-DSCGI-PATH header and on traffic from the IPs listed in public advisories.
  7. Plan the 22.8 migration before the January 2027 end-of-life date.

Need to know whether your external perimeter exposes a vulnerable VPN appliance? 4Tify's vulnerability assessments identify internet-facing edge devices and flag known-exploited CVEs, so your team can act before attackers do.

Credit: this summary is based on reporting by The Hacker News, drawing on advisories and research from CISA, Volexity and Previdian.

COMPARTIR