Ivanti disclosed CVE-2026-104935 in Ivanti Connect Secure (ICS) on 13 October 2026 and said it is aware of limited exploitation in the wild, urging customers on affected versions to act immediately, upgrade to the fixed release and run the Integrity Checker Tool regularly. The CVE record describes an authentication bypass by spoofing that lets a remote unauthenticated attacker execute arbitrary commands; ICS 22.7R2.14 and earlier are not affected.

Volexity, which found and reported the issue, says a previously unknown actor it tracks as UTA0576 exploited a fully patched 22.8R2.4 appliance from 3 October 2026. The chain abused a request-routing bypass in the public welcome.cgi page (an X-DSCGI-PATH header pointing at an internal script), a race in the wu.cgi upload handler to run a briefly written Perl script, and a separate privilege escalation in the dsinvoked broker's trust of DSCache data to reach root.

Ivanti tracks the bypass and RCE together as CVE-2026-104935; BleepingComputer reports the privilege escalation is still being fixed. The actor deployed no web shell, re-exploited the device for each command, tampered with debug and audit logs and evaded the Integrity Checker.

Post-exploitation targeted Active Directory: LDAP service credentials stored on the appliance, LAPS passwords, BitLocker recovery keys, Kerberoasting and password spraying.

Defused reports first exploitation signs from 1 October, and Shadowserver tracks more than 5,500 internet-exposed ICS instances. CISA added CVE-2026-104935 to its Known Exploited Vulnerabilities catalog on 13 October, with a 16 October patch deadline for US federal agencies, and issued an alert saying it is aware of actors using the flaw for credential theft and data exfiltration.

CISA warns the Integrity Checker may miss exploitation because commands run in memory, so confirming compromise needs network and memory forensics, and it says Connect Secure 22.8 reaches end of life on 31 January 2027.

Rapid7 reports Ivanti had found part of the issue internally and fixed it in 25.1.3.0 in July, and exploitation came while backports to other branches were still under way; iTnews lists 25.1.1.2 among the fixed builds. Volexity assesses with medium confidence that UTA0576 used large language models to build its tooling.

On 14 October The Hacker News reported that Previdian honeypot sensors had logged 105 exploitation attempts from 50 unique IPs (mainly Singapore and the US) as of that date, using the X-DSCGI-PATH header to reach an internal CGI handler and upload Perl scripts packaged as ZIP files that return execution-test markers; payloads seen so far were mostly weaponisation probes rather than full malware drops.

Sample source IPs published by Previdian include 216.73.160[.]59, 216.73.160[.]61, 216.73.160[.]210 and 45.8.19[.]111.

UPDATE (23 Oct 2026): the privilege escalation now has its own CVE record, CVE-2026-111357 (published 15 October, updated 16 October): Ivanti Connect Secure 22.8R2.4 mishandles how the dsinvoked broker trusts DSCache configuration data, leading to root, 'as exploited in the wild in October 2026'. The record scores it CVSS 3.1 7.0 (AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H) and lists no fixed version as of its 16 October update.

Volexity's 13 October post says Ivanti is working on a fix that will be included in a future release 'in the coming weeks'.

CVE-2026-111357 was not in CISA's KEV catalog as of the 23 October catalog release (version 2026.10.23). (source: CVE-2026-111357 record (cve.org); Volexity)