CVE-2026-104935

CVE-2026-104935, the entry point. CISA's KEV entry, added October 13, 2026, describes "an authentication bypass by spoofing vulnerability that allows a remote unauthenticated attacker to execute arbitrary commands." The NVD record says it affects ICS before 25.1.3.0 and does not affect 22.7R2.14 or earlier. Volexity reports that a request to the public login script /dana-na/auth/url_default/welcome.cgi carrying an X-DSCGI-PATH header naming a protected script makes the appliance run that script, and a race in the wu.cgi upload handler turns that into code execution as the cgi-server user. CISA's due date was October 16, 2026. That date has passed.

CVE-2026-111357, root. Added to KEV October 30, due November 2, forensic triage required. CISA's text: "Ivanti Connect Secure contains a missing authentication for critical function vulnerability that could allow a local authenticated attacker to escalate their privileges. This vulnerability can be chained with CVE-2026-104935 and CVE-2026-118527." NVD lists 7.0 (AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H) from MITRE and describes the flaw as the way "the dsinvoked broker trusts DSCache configuration data, leading to privilege escalation to root." Volexity reports Ivanti published the fix on October 29, 2026.

CVE-2026-118527, file upload. Added to KEV October 30, due November 13, forensic triage not required. CISA's text: "Ivanti Connect Secure contains a generation of predictable numbers or identifiers vulnerability that allows a remote authenticated attacker to upload files with attacker-controlled content to a known location on disk. This vulnerability can be chained with CVE-2026-104935 and CVE-2026-111357." As of October 30 it has no score and no NVD record.

Exploitation in the wild. Volexity reports that a threat actor it tracks as UTA0576 exploited the chain from October 3, 2026 against an appliance running 22.8R2.4 (Build 19097), then the latest release, gaining root without logging in. Volexity reports the actor stole credentials stored on the appliance, queried Active Directory for LAPS passwords and BitLocker recovery keys, password sprayed, captured LDAP traffic, and removed entries from /home/runtime/dlogs/debuglog and /var/log/audit/audit.log. Volexity assesses with low confidence that the motive is criminal rather than espionage, and names no targets. No backdoor or web shell was deployed; each command re-ran the exploit chain. Ivanti, as reported by SecurityOnline on October 30, says it is "aware of exploitation in the wild affecting a limited number of customers" when the three CVEs are chained.

One test decides exposure. The portal plus the build. Run these only on appliances your organization owns.

1. Build number. In the admin console, read the running ICS version. NVD's configuration for CVE-2026-104935 lists as vulnerable 25.1.0.0 up to but not including 25.1.1.2, 25.1.2.0 up to but not including 25.1.3.0, and 22.8R2 through 22.8R2.4. 22.7R2.14 and earlier are not affected. For CVE-2026-111357, NVD (updated October 30) lists 25.1.0.0 up to but not including 25.1.1.3, and 22.8R2 through 22.8R2.5. If you are on 22.8R2.5 or 25.1.1.2, you fixed the first flaw and not the second.
2. Internet exposure. Check whether the VPN portal, including /dana-na/auth/url_default/welcome.cgi, answers from the internet or another untrusted network. If both 1 and 2 are yes, the chain is reachable.
3. Compromise check. Run Ivanti's Integrity Checker Tool, which Ivanti's October 29 update tells customers to run regularly, but do not treat a clean result as proof. Volexity reports that because this chain patches library code in memory and restores configuration data, "the tool does not detect any modifications," and that forensic investigation is required.

Fixed builds. We could not read Ivanti's advisory directly as of October 30, 2026, so the following is attributed to the sources we could read. Confirm the build for your release train on Ivanti's page before you rely on it.

• CVE-2026-104935, fixed October 13. Per watchTowr's FAQ quoting Ivanti, 25.1.1.2 on ISA6000 and ISA8000; 25.1.3.0 or 25.1.3.1 on ISA4500, ISA6500 and ISA8500; 22.8R2.5 as an interim, with Ivanti recommending a move to 25.1.1.2 or later. This matches NVD's ranges.
• CVE-2026-111357, fixed October 29 per Volexity. NVD's ranges put the fix at 25.1.1.3 on the 25.1.1 line and after 22.8R2.5 on the 22.8 line. SecurityOnline, citing Ivanti's October 29 advisory update, lists 25.1.1.3, 25.1.3.1 and 22.8R2.6 as the upgrade targets.
• CVE-2026-118527. No source we could read names a fixed build. Ivanti's statement that a fix is available for all chained vulnerabilities is the only indication that the October 29 release covers it.

Not the same as the 2025 Connect Secure entries. CVE-2025-0282 (KEV January 8, 2025) and CVE-2025-22457 (KEV April 4, 2025) are separate flaws with separate fixes. Patching those does not cover this chain, which affects later builds including 22.8R2.4 and 25.1.x before 25.1.3.0.

The patch is the only fix, and this chain has fewer compensating controls than most, because the attacker's first step needs nothing but the login page. Each control works only under the condition at the end of its line.

• Delivery. Take the portal off the internet, or restrict it to known source addresses at the firewall, until the appliance is on a build that fixes all three CVEs. This only helps if every route to the portal is covered, including load balancers and secondary interfaces.
• Exploitation. Block or alert on requests to /dana-na/auth/url_default/welcome.cgi carrying an X-DSCGI-PATH header, which Volexity identifies as the exploit pattern. This only helps if the filter sits in front of the appliance, runs in block mode, and inspects decrypted traffic.
• Blast radius. Before trusting an appliance that was exposed on a vulnerable build, run the Integrity Checker Tool and a memory and network forensic review, and rotate the credentials it stores, including its Active Directory service account, since Volexity reports those were taken. This only helps if you treat a clean Integrity Checker result as incomplete, because Volexity reports the chain leaves no on-disk changes.

The patch is the only fix. Per NVD and the sources above, 25.1.1.2, 25.1.3.0 or 22.8R2.5 for CVE-2026-104935, and Ivanti's October 29, 2026 release (reported as 25.1.1.3, 25.1.3.1 and 22.8R2.6) for CVE-2026-111357. Confirm on Ivanti's advisory.

All indicators are from Volexity's October 13, 2026 write-up, which also points to a Volexity GitHub repository for related indicators.

• Large numbers of requests to /dana-na/auth/url_default/welcome.cgi with headers such as X-DSCGI-PATH: /home/webserver/htdocs/dana/fb/smb/wu.cgi or X-DSCGI-PATH: /home/runtime/tmp/<MD5(filename)>. Volexity advises watching for mismatches between the URL path and the X-DSCGI-PATH value.
• Files in /tmp/ such as ml.py, rq5.py, mk.py, rr.py, pu.txt, sp_out.txt and spray_hits.json.
• A hidden directory /data/.icscap/ with h.py, cap* capture files, or a renamed tcpdump at /data/.icscap/dsstatmond.
• Files matching /home/runtime/tmp/ics-root-run-inband-*.pl or ics-root-result-inband-*.
• Gaps or removed entries in /home/runtime/dlogs/debuglog and /var/log/audit/audit.log.
• Infrastructure: 108.165.147[.]64 (Evoxt VPS), seen by Volexity running OpenVPN from September 30 to October 7, 2026.

Am I affected by CVE-2026-104935 if I patched the January 2025 Ivanti flaw?

Possibly. That fix addressed CVE-2025-0282. CVE-2026-104935 is a separate flaw affecting later builds, including 22.8R2.4.

Does a clean Ivanti Integrity Checker result mean my appliance is safe?

Not for this chain. Volexity reports the attacker patched code in memory only, so the checker did not detect changes. Ivanti still tells customers to run it regularly; treat it as one input, not the verdict.

Do I need to check CVE-2026-111357 and CVE-2026-118527 separately?

For exposure, no. If an attacker cannot reach a portal on a build vulnerable to CVE-2026-104935, the chain does not start. You still need the patches for all three, and a build that fixes the first does not necessarily fix the second.

What version fixes the Ivanti Connect Secure chain?

For CVE-2026-104935, 25.1.1.2, 25.1.3.0 or later, or 22.8R2.5, per NVD and watchTowr quoting Ivanti. For CVE-2026-111357, Ivanti's October 29 release, reported as 25.1.1.3, 25.1.3.1 and 22.8R2.6. Confirm on Ivanti's advisory for your release train and hardware.

Is CVE-2026-104935 being exploited?

Yes. CISA added it to KEV on October 13, 2026, and Volexity reports exploitation of the full chain since October 3 by an actor it tracks as UTA0576. Ivanti says it is aware of exploitation affecting a limited number of customers.

Oct 30, 2026. First published, the day CISA added CVE-2026-111357 and CVE-2026-118527 to KEV. Fixed builds for the two new CVEs are from NVD, Volexity and SecurityOnline; Ivanti's advisory could not be loaded.

• CISA Known Exploited Vulnerabilities catalog (CVE-2026-104935 added Oct 13; CVE-2026-111357 and CVE-2026-118527 added Oct 30; checked in the JSON feed, catalog 2026.10.30)
• Volexity, A Series of Unauthenticated Events (Oct 13, 2026, updated Oct 29)
• NIST NVD: CVE-2026-104935 and CVE-2026-111357 (version ranges)
• Ivanti security advisory for CVE-2026-104935 (updated Oct 29; not loadable from our side on Oct 30)
• watchTowr FAQ on CVE-2026-104935 (fixed builds per hardware, quoting Ivanti; updated Oct 26)
• SecurityOnline (Oct 30, 2026), Ivanti's Oct 29 advisory update statements and upgrade targets