Researchers have identified CVE-2026-104935, a high-severity authentication bypass and remote code execution (RCE) vulnerability affecting Ivanti Connect Secure (ICS) VPN appliances. The vulnerability is being actively exploited in the wild and allows attackers to execute arbitrary commands without credentials or user interaction. Secure you and your clients environments now.
What is the threat?
CVE-2026-104935 is a high-severity authentication bypass and remote code execution vulnerability affecting Ivanti Connect Secure VPN appliances. The flaw has a CVSS score of 8.6 and can be exploited remotely without authentication.
According to Volexity, threat actor UTA0576 exploited the vulnerability alongside a separate privilege-escalation flaw to gain unauthorized root access. The attack chain allowed the threat actor to execute malicious code, elevate privileges, and evade detection through in-memory execution and anti-forensic techniques. Ivanti has released patches for CVE-2026-104935, but the privilege-escalation vulnerability used in observed attacks remains unpatched.
Why is it noteworthy?
This vulnerability is noteworthy because it allows attackers to compromise internet-facing VPN appliances without valid credentials or user interaction. The observed attack chain combines authentication bypass, remote code execution, privilege escalation, and anti-forensic techniques to achieve root-level access. Attackers were also observed removing logs and minimizing evidence of compromise, making detection and investigation more difficult.
The vulnerability is actively being exploited in the wild, increasing the urgency for organizations running affected Ivanti Connect Secure appliances.
What is the exposure or risk?
Successful exploitation provides attackers with root-level access to affected Ivanti Connect Secure appliances.
According to Volexity, observed post-exploitation activity included Active Directory data collection, LDAP packet capture, authentication log reconnaissance, network reconnaissance, password spraying, and anti-forensics activity.
Organizations could face credential theft, unauthorized network access, data exfiltration, and further compromise of internal systems if affected devices remain unpatched.
What are the recommendations?
Barracuda strongly recommends the following actions to reduce risk:
1. Apply security updates immediately
Upgrade affected Ivanti Connect Secure systems to supported versions that address CVE-2026-104935. Organizations unable to migrate immediately should apply the latest available fixes for their supported code branch.
2. Plan migration from legacy versions
Ivanti Connect Secure version 22.7 reaches end of life on January 31, 2027. Organizations should plan migration to the 25.1 code branch before that date.
3. Perform forensic analysis on suspected devices
Conduct memory and network forensic analysis on potentially affected appliances because the exploit chain relies heavily on in-memory execution.
4. Monitor for exploitation attempts
Investigate requests to welcome.cgi, especially those involving unexpected or privileged X-DSCGI-PATH values.
5. Review logs and configurations
Look for indicators of authentication bypass, privilege escalation, unauthorized script execution, and log manipulation.
6. Inspect temporary file locations
Review the /tmp directory and related locations for suspicious files, scripts, or artifacts associated with exploitation activity.
References
For more information, review the following resource:
- https://hub.ivanti.com/s/article/Security-Advisory-Ivanti-Connect-Secure-CVE-2026-104935?language=en_US
- https://www.volexity.com/blog/2026/10/13/a-series-of-unauthenticated-events-chained-exploitation-of-ivanti-connect-secure-zero-days/
If you have any questions about this Cybersecurity Threat Advisory, don’t hesitate to get in touch with Barracuda Managed XDR’s Security Operations Center.
