Ivanti Connect Secure auth bypass exploited; CISA gave agencies three days

CISA added CVE-2026-104935, an authentication bypass by spoofing (CWE-290, CVSS 8.6) in Ivanti Connect Secure, to its Known Exploited Vulnerabilities catalog on October 13 and gave federal agencies until October 16 to fix it. A remote, unauthenticated attacker can run commands on the VPN appliance; watchTowr traced it to one request with a crafted X-DSCGI-PATH header. Affected releases are 22.8R2.4, 25.1.1.1 and 25.1.2.2 and earlier; 22.8R2.5 and 25.1.3.0 and later are not affected. Volexity saw a group it tracks as UTA0576 exploiting it from October 3, chained with a privilege escalation flaw that remains unpatched, and leaving no malware behind. CISA says confirming compromise requires network and memory forensics, and that compromised appliances need a factory reset plus password, certificate and API key rotation.

Why it matters

The attackers did not stop at the appliance. Volexity reports they extracted stored credentials including LDAP domain accounts, hunted Active Directory for admin passwords and BitLocker recovery keys, captured LDAP traffic and ran Kerberoasting and password spraying. The VPN was the route to the directory.

So patching is step one of three. Rotate the LDAP bind account and everything the appliance stored, reset passwords on Kerberoastable service accounts, and look for directory authentication from the appliance's address since October 1. Our CVE-2026-104935 brief has the full list and the earlier Connect Secure bypass it echoes.

Source: The Hacker News