---
title: Ivanti Connect Secure CVE-2026-104935: zero-day chain exploited since Oct 3; root privesc still unpatched; on KEV, due Oct 16 | ctxsec
url: https://ctxsec.com/items/cve-2026-104935
description: ""
status: "confirmed (vendor, Volexity, CISA KEV)"
published: 2026-10-13
---

> 

[← Cybersecurity News](/news) · [markdown](/items/cve-2026-104935.md)

confirmed (vendor, Volexity, CISA KEV)

2026-10-13

### Ivanti Connect Secure CVE-2026-104935: zero-day chain exploited since Oct 3; root privesc still unpatched; on KEV, due Oct 16

Authentication bypass leading to remote code execution (CVSS 8.6), on CISA KEV since Oct 13 with an Oct 16 due date. **Volexity** says actor UTA0576 exploited it from Oct 3 against an appliance that was fully patched at the time (22.8R2.4): a `welcome.cgi` auth bypass via the `X-DSCGI-PATH` header plus a race in `wu.cgi` uploads, chained with a separate **privilege escalation (dsinvoked/DSCache) that Ivanti has not yet fixed**. Post-exploitation targeted AD credentials, LAPS passwords and BitLocker keys, with log tampering. The chain patches code in memory only, so **Ivanti's Integrity Checker does not detect it**; memory and network forensics are needed. Fixed (auth bypass/RCE) in 22.8R2.5 and 25.1.3.0. Hunt: high volumes of requests to `/dana-na/auth/url_default/welcome.cgi` where the URL path and X-DSCGI-PATH header mismatch; check `/tmp/`. Defused says its honeypots caught what it believes is this exploit on Oct 1 (unconfirmed by Ivanti).

Sources: [Ivanti advisory](https://forums.ivanti.com/s/article/Security-Advisory-Ivanti-Connect-Secure-CVE-2026-104935) · [Volexity: chained exploitation of ICS zero-days](https://www.volexity.com/blog/2026/10/13/a-series-of-unauthenticated-events-chained-exploitation-of-ivanti-connect-secure-zero-days/) · [CISA KEV](https://www.cisa.gov/known-exploited-vulnerabilities-catalog) · [@DefusedCyber (honeypot claim)](https://x.com/DefusedCyber/status/2110040892572602788)