Published on October 14, 2026
Ivanti Connect Secure 0-Days Exploited to Steal Active Directory Credentials
Severity
High
Detail
Ivanti has released security updates to address CVE-2026-104935, an authentication bypass by spoofing vulnerability affecting Ivanti Connect Secure (ICS). The vulnerability could allow a remote unauthenticated attacker to execute arbitrary commands on affected appliances. Ivanti has confirmed that the vulnerability is being exploited in the wild against a limited number of customers.
According to Volexity, threat actors exploited vulnerability as part of a broader attack chain targeting Ivanti Connect Secure appliances. The observed activity involved unauthorized access to affected devices, attempts to obtain Active Directory credentials, Local Administrator Password Solution (LAPS) passwords, BitLocker recovery keys, and other sensitive directory information. Attackers were also observed conducting credential theft, password-spraying activities, and network reconnaissance after gaining access.
Researchers observed successful exploitation against appliances running version 22.8R2.4, demonstrating that fully patched devices remained vulnerable prior to the release of the latest security updates. Organizations are strongly advised to apply the available patches immediately and investigate exposed appliances for indicators of compromise.
| CVE ID | Summary | CVSS Score |
| CVE-2026-104935 | Authentication bypass by spoofing vulnerability in Ivanti Connect Secure that could allow a remote unauthenticated attacker to execute arbitrary commands on affected appliances. | 8.6 (High) |
Affected Products
The vulnerability affects the following Ivanti Connect Secure (ICS) versions:
- 25.1.1.1 and earlier
- 25.1.2.2 and earlier
- 22.8R2.4 and earlier
The vulnerability has been addressed in the following versions:
- 25.1.1.2
- 25.1.3.0 / 25.1.3.1
- 22.8R2.5
Recommendation
Organizations should implement the following measures immediately:
- Apply the latest security updates released by Ivanti addressing CVE-2026-104935.
- Review logs for repeated requests to:
- /dana-na/auth/url_default/welcome.cgi
- Requests containing the X-DSCGI-PATH header.
- Investigate systems for suspicious files created under /tmp/ and hidden directories associated with attacker activity.
- Review Active Directory logs for unauthorized LDAP queries, password-spraying attempts, or unusual authentication activity originating from VPN appliances.