A critical authentication bypass flaw in Ivanti Connect Secure, one of the most widely deployed enterprise VPN products, is being actively exploited by attackers who can execute commands without ever supplying a password. Ivanti disclosed the vulnerability, tracked as CVE-2026-104935, on Tuesday, and the U.S. Cybersecurity and Infrastructure Security Agency immediately added it to its Known Exploited Vulnerabilities catalog, giving federal agencies just three days to patch. The flaw affects all versions of Connect Secure before 25.1.3 and has already been tied to intrusions against a small but growing number of organizations.
The episode is a reminder that corporate remote-access infrastructure, not just consumer-facing tools, carries real exposure when vulnerabilities go unpatched. For everyday users weighing privacy options, the contrast is instructive: consumer VPN services generally compete on transparency, independent audits, and features like servers optimised for streaming, whereas enterprise remote-access appliances sit on the public internet as high-value targets precisely because they serve as gateways into internal networks. That difference in threat model explains why flaws in products like Connect Secure attract sophisticated, persistent attackers rather than opportunistic ones.
How the Bypass Works
According to Yordan Ganchev, principal threat intelligence specialist at watchTowr, the root cause is strikingly simple. A single request containing a specially crafted X-DSCGI-PATH header is enough to bypass the login check entirely, granting access to functionality normally reserved for authenticated sessions. Because this bypass uses a code path separate from standard authentication, existing login protections do not catch it. Once inside, an attacker can run arbitrary commands on the appliance without a username, password, or any other credential, effectively impersonating a trusted, logged-in session.
Ganchev noted that Ivanti Connect Secure has a long history as a target for ransomware operators and state-linked groups alike. CVE-2026-104935 now joins fourteen other Connect Secure and Pulse Connect Secure vulnerabilities already listed in the CISA KEV catalog. Given that pattern, he expects exploitation to shift quickly from narrow, targeted intrusions to broad, indiscriminate scanning and attack campaigns across the internet.
A Chained Attack With Root-Level Access
Digital forensics firm Volexity first spotted suspicious activity in a customer environment on October 5 and traced it to a previously unknown threat actor it now tracks as UTA0576. Volexity found that, starting October 3, the group chained three separate vulnerabilities to compromise Connect Secure appliances and execute commands with root privileges. Two of those flaws fall under CVE-2026-104935: an authentication bypass in the appliance's welcome.cgi script and a file-write vulnerability in wu.cgi, the component that handles file uploads. These were combined with a privilege-escalation bug in dsinvoked, a privileged system process that trusts configuration data from a component called DSCache, allowing the attacker to escalate from web-level access to full root control.
Post-compromise, UTA0576 went after Active Directory credentials and secrets, including Local Administrator Password Solution passwords and BitLocker recovery keys. The group also deployed a custom Kerberos tool for Kerberoasting and credential testing, harvested VPN configuration data, and conducted password spraying - all signs, Volexity said, of preparation for lateral movement and a wider compromise of victim networks. Notably, the attackers left no backdoor or web shell behind, instead routing commands and stolen data through the HTTPS requests used in the exploit chain itself, and deleting traces from Ivanti's debug logs and Linux audit logs to cover their tracks.
What Organizations Should Do Now
Ivanti says its security team discovered the flaw internally and patched it in the July release, and was in the process of backporting the fix to older supported versions when exploitation began - underscoring how narrow the window can be between internal discovery and real-world abuse. Security teams running Connect Secure should treat patching as urgent, not routine, and should also hunt for signs of prior compromise rather than assume a clean deployment.
- Upgrade to Connect Secure 25.1.3 or later immediately
- Review debug and audit logs for signs of tampering or deletion
- Rotate Active Directory credentials, LAPS passwords, and BitLocker recovery keys exposed to the appliance
- Monitor for Kerberoasting activity and unusual password-spraying attempts
The incident fits a familiar arc for edge-network appliances: a vendor-discovered flaw, a delayed patch rollout, and attackers moving faster than defenders can respond. As remote work keeps VPN gateways permanently exposed to the internet, the margin for error on patching cycles keeps shrinking.
