# Ivanti Connect Secure authentication bypass by spoofed header, exploited as a zero-day

Source: https://startwithidentity.com/cves/cve-2026-104935/
Last updated: 2026-10-14
License: content by Start with Identity. Cite the source URL.

---

## What broke

CVE-2026-104935 (CVSS 8.6, CWE-290 authentication bypass by spoofing) lets a remote, unauthenticated attacker skip Ivanti Connect Secure's authentication and run commands. watchTowr traced the root cause to a single request carrying a crafted `X-DSCGI-PATH` header that reaches an internal CGI handler the login was supposed to guard.

Affected: 22.8R2.4 and earlier, 25.1.1.1 and earlier, and 25.1.2.2 and earlier. Releases 22.8R2.5, 25.1.3.0 and 25.1.3.1 are not affected, and 22.7R2.14 and earlier never were. CISA added the flaw to its Known Exploited Vulnerabilities catalog on October 13, 2026 with an October 16 deadline.

Volexity saw an actor it tracks as UTA0576 exploiting it from October 3, chained with a privilege escalation flaw that Ivanti has not yet fixed, to reach root on an appliance that was fully patched at the time. The actor dropped no malware or web shell and evaded Ivanti's Integrity Checker Tool by re-running the chain for each command.

## Why it matters

A VPN gateway exists to decide who is allowed inside, so a bypass here turns an anonymous internet request into a position past the front door. What UTA0576 did next is the identity lesson: it pulled stored credentials, including LDAP domain credentials, from the appliance, searched Active Directory for administrator passwords and BitLocker recovery keys, captured LDAP traffic, and ran [Kerberoasting](https://startwithidentity.com/techniques/kerberoasting/) and password spraying. The gateway was a stepping stone to the directory.

This is the same product and failure class as [CVE-2023-46805](https://startwithidentity.com/cves/cve-2023-46805/) and the SAML SSRF in [CVE-2024-21893](https://startwithidentity.com/cves/cve-2024-21893/).

## What to do

- Upgrade to 22.8R2.5 or 25.1.3.0 or later. Version 22.8 reaches end of life on January 31, 2027.
- Alert on inbound requests carrying an `X-DSCGI-PATH` header.
- Do not treat a clean Integrity Checker result as proof of safety. CISA says determining compromise needs network and memory forensics.

## After you patch

- If compromise is found, CISA's sequence is: back up the configuration, factory reset and upgrade (or rebuild virtual instances), restore, then reset all account passwords and revoke and reissue certificates, API keys and license server credentials.
- Rotate the LDAP bind account and any domain credentials the appliance stored.
- Reset Kerberoastable service account passwords and review directory logs for spraying from the appliance's address.

## Sources

- [NVD: CVE-2026-104935](https://nvd.nist.gov/vuln/detail/cve-2026-104935)
- [Ivanti security advisory](https://hub.ivanti.com/s/article/Security-Advisory-Ivanti-Connect-Secure-CVE-2026-104935)
- [CISA Known Exploited Vulnerabilities catalog](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-104935)
- [Volexity, October 13, 2026](https://www.volexity.com/blog/2026/10/13/a-series-of-unauthenticated-events-chained-exploitation-of-ivanti-connect-secure-zero-days/)