- CISA urges immediate patching of Ivanti Connect Secure due to an actively exploited authentication bypass vulnerability, CVE-2026-104935.
- The zero-day allows remote unauthenticated command execution, enabling credential theft and data exfiltration.
- Exploitation attempts have been observed from 50 unique IP addresses, with threat actors using the X-DSCGI-PATH header to upload Perl scripts.
- A previously undocumented threat actor, UTA0576, has been exploiting the flaw since October 3, 2026, for credential extraction and Kerberoast attacks.
On October 13, 2026, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) urged organizations to immediately update their Ivanti Connect Secure appliances following the disclosure of an actively exploited authentication bypass vulnerability. The security flaw, tracked as CVE-2026-104935 with a CVSS score of 8.6, impacts ICS versions 25.1.1.1 and prior, 25.1.2.2 and prior, and 22.8R2.4 and prior.
CISA is aware of cyber threat actors exploiting this zero-day to conduct credential theft and data exfiltration, as “CISA is aware of cyber threat actors exploiting this zero-day authentication bypass vulnerability, which allows remote, unauthenticated execution of arbitrary commands, to conduct credential theft and data exfiltration,” the agency said. The agency has added the flaw to its Known Exploited Vulnerabilities catalog, requiring Federal Civilian Executive Branch agencies to apply fixes by October 16, 2026.
CISA recommends reviewing Ivanti’s Connect Secure Upgrade and Migration Compatibility Guide for patching guidance, noting that version 22.8 reaches end-of-life on January 31, 2027. Organizations seeking to determine compromise should conduct network and memory forensics to identify evidence of exploitation.
According to Previdian, 105 exploitation attempts have been observed targeting its honeypot sensors as of October 14, 2026, originating from 50 unique IP addresses geolocated to Singapore and the U.S. Previdian founder and CEO Ryan Dewhurst noted that threat actors are using the X-DSCGI-PATH header to reach an internal CGI handler and upload Perl scripts dressed as ZIP files.
“We’re seeing coordinated attempts to exploit this Ivanti vulnerability, but the payloads captured so far are primarily testing for code execution rather than deploying malware, or compromising the device,” Dewhurst told The Hacker News. However, full weaponized exploitation is likely to follow in the coming hours and days.
In a separate report, Volexity said it first observed exploitation on October 3, 2026, with a previously undocumented threat actor dubbed UTA0576 leveraging it in conjunction with a privilege escalation vulnerability to achieve unauthenticated root-level code execution. Following successful exploitation, the threat actor engaged in broad post-exploitation actions, including extracting credentials, deploying a Kerberos tool for Kerberoast attacks, and conducting LDAP packet capture.
✅ Follow BITNEWSBOT on Telegram, Facebook, LinkedIn, X.com, and Google News for instant updates.
