Threat reportVulnerabilityTL-2026-3420
Ivanti Connect Secure Authentication Bypass by Spoofing Zero-Day (CVE-2026-104935) Exploited in the Wild
Ivanti Connect Secure Authentication Bypass by Spoofing (TL-2026-3420) is a critical-severity software vulnerability scored CVSS 8.6, first published 2026-10-13 and last reviewed 2026-10-15. It is attributed to UTA0576 with low confidence, affects Ivanti Connect Secure, references 1 CVE (CVE-2026-104935), maps to 28 MITRE ATT&CK techniques (T1005, T1016, T1027), and is covered by 9 detection rules and 49 indicators of compromise.
- CVSS
- 8.6/10Critical
- CVEs
- 1Referenced vulnerabilities
- Techniques
- 28MITRE ATT&CK
- Actors
- 1UTA0576
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 49Indicators of compromise
Key facts for TL-2026-3420
- Threat ID
- TL-2026-3420
- Severity
- CRITICAL
- CVSS
- 8.6
- Status
- ACTIVE
- Category
- VULNERABILITY
- First published
- Last reviewed
- Attribution
- UTA0576
- Attribution confidence
- LOW
- Motivation
- FINANCIAL
- Target sectors
- government administration, technology, finance, health, telecoms
- Target regions
- Global
- Detection rules
- 9
- Indicators of compromise
- 49
- Updates
- 2026-10-15 · 8 updates · revalidated 8× · latest source
Malware and tooling in Ivanti Connect Secure Authentication Bypass by Spoofing
Malware and tooling: Ivanti Integrity Checker Tool (ICT)
How Ivanti Connect Secure Authentication Bypass by Spoofing works
Ivanti disclosed CVE-2026-104935, an authentication bypass by spoofing flaw in Ivanti Connect Secure (ICS) that lets a remote unauthenticated attacker execute arbitrary commands on the appliance. Ivanti is aware of limited exploitation in the wild at disclosure, and CISA added the flaw to the KEV catalog on 2026-10-13 with a 2026-10-16 remediation due date.
CVE-2026-104935 is an authentication bypass by spoofing vulnerability (CISA KEV name: 'Ivanti Connect Secure Authentication Bypass by Spoofing Vulnerability'; CWE-290 per secondary reporting) in Ivanti Connect Secure, the SSL VPN gateway deployed at network perimeters. According to Ivanti and CISA, a remote unauthenticated attacker can exploit it in low-complexity attacks, with no user interaction, to execute arbitrary commands on the targeted appliance. Ivanti's October 2026 security update states that it is aware of limited exploitation in the wild at the time of disclosure. Volexity is credited with reporting the flaw.
Affected versions per Ivanti advisory coverage: ICS 22.8R2.4 and earlier, 25.1.2.2 and earlier, and 25.1.1.1 and earlier. Secondary reporting (SecurityOnline) lists fixed releases 22.8R2.5, 25.1.1.2, and 25.1.3.0/25.1.3.1, and states that 22.7R2.14 and earlier are not impacted; the Ivanti advisory page could not be rendered by the research tooling, so these fixed-version details should be confirmed against the vendor advisory. SecurityOnline also reports a CVSS base score of 8.6 (High); NVD had no record at research time and the vector string was not published in any retrieved source, so none is recorded here.
Exploitation status: CISA added the CVE to the Known Exploited Vulnerabilities catalog on 2026-10-13 with a due date of 2026-10-16 and references BOD 26-04 and forensics triage requirements. No public proof-of-concept was identified. Shadowserver tracks over 5,500 internet-exposed ICS instances, although that count includes honeypots and potentially already-secured instances. No IOCs (IPs, domains, hashes), malware families, or threat-actor attribution were published in any retrieved source; no BeaconBeagle correlation was possible because no network indicators exist yet.
Vendor guidance: upgrade to a fixed version immediately, review the security advisory, run Ivanti's Integrity Checker Tool (ICT) regularly, and apply layered security (strong access controls, network monitoring, log review, appliance integrity validation). Because the appliance is an edge device and exploitation yields command execution, defenders should treat any unpatched, internet-facing ICS as potentially compromised and perform forensics triage in addition to patching.
MITRE ATT&CK techniques used in TL-2026-3420
Collection
T1005 Data from Local System; T1074.001 Local Data Staging
Discovery
T1016 System Network Configuration Discovery; T1083 File and Directory Discovery; T1087.002 Domain Account
Defense Evasion
T1027 Obfuscated Files or Information; T1036.003 Rename Legitimate Utilities; T1036.005 Match Legitimate Resource Name or Location; T1055.009 Process Injection: Proc Memory; T1070.002 Clear Linux or Mac System Logs; T1070.004 File Deletion; T1140 Deobfuscate/Decode Files or Information; T1564.001 Hidden Files and Directories
Credential Access
T1040 Network Sniffing; T1110.003 Password Spraying; T1552.001 Credentials In Files; T1556 Modify Authentication Process; T1558.003 Kerberoasting
Exfiltration
T1041 Exfiltration Over C2 Channel
Execution
T1059 Command and Scripting Interpreter; T1059.004 Unix Shell; T1059.006 Python
Privilege Escalation
T1068 Exploitation for Privilege Escalation
Command and Control
T1071.001 Application Layer Protocol: Web Protocols; T1105 Ingress Tool Transfer
Initial Access
T1133 External Remote Services; T1190 Exploit Public-Facing Application
Persistence
T1133 External Remote Services
defense-impairment
T1556 Modify Authentication Process
Resource Development
Affected products and versions in Ivanti Connect Secure Authentication Bypass by Spoofing
- Ivanti — Connect Secure
Vulnerable versions: 22.8R2.4 and earlier; 25.1.2.2 and earlier; 25.1.1.1 and earlier
Fixed in: 22.8R2.5; 25.1.1.2; 25.1.3.0; 25.1.3.1
Remediation for Ivanti Connect Secure Authentication Bypass by Spoofing
Patches
- Ivanti Connect Secure 22.8R2.5
- Ivanti Connect Secure 25.1.1.2
- Ivanti Connect Secure 25.1.3.0 and 25.1.3.1
Immediate actions
- Upgrade Ivanti Connect Secure to a fixed release (22.8R2.5, 25.1.1.2, or 25.1.3.0/25.1.3.1 per secondary reporting; confirm against the Ivanti advisory)
- Run the Ivanti Integrity Checker Tool (ICT) on all ICS appliances and investigate any failures
- Perform forensics triage on internet-exposed ICS appliances that ran affected versions, per CISA BOD 26-04 guidance
- Meet the CISA KEV remediation due date of 2026-10-16 for federal agencies
Longer-term hardening
- Run the Integrity Checker Tool regularly
- Apply layered security: strong access controls, network monitoring, log review, and appliance integrity validation
- Reduce exposure of VPN management and gateway interfaces to the internet where feasible
CVEs associated with Ivanti Connect Secure Authentication Bypass by Spoofing
Weaknesses (CWE) in Ivanti Connect Secure Authentication Bypass by Spoofing
Timeline of Ivanti Connect Secure Authentication Bypass by Spoofing
Showing the 20 most recent tracked events.
- Volexity publishes research on UTA0533 performing similar PCAP-based credential collection on SonicWall SMA devices (related activity, different actor).
- UTA0576 VPS 108.165.147.64 (Evoxt) becomes operational.
- Defused Cyber reports possible first exploitation of the flaw (per BleepingComputer); Volexity-observed exploitation begins 2026-10-03.
- UTA0576 begins exploiting Ivanti Connect Secure appliances as a zero-day (per Volexity).
- Volexity begins investigating the intrusion activity.
- Connect Secure 25.1.1.2 released, fixing 25.1.1.1 and earlier.
- Last observed use of the 108.165.147.64 VPS.
- Volexity shares IOCs with its threat-intelligence customers.
- Connect Secure 22.8R2.5 released, fixing 22.8R2.4 and earlier.
- Volexity publishes full analysis showing CVE-2026-104935 (auth bypass + file-write RCE) was chained with a third Ivanti Connect Secure zero-day for root privilege escalation via dsinvoked/DSCache; that privilege escalation flaw remained unpatched at disclosure and the Integrity Checker Tool cannot detect the in-memory-only modification.
- BleepingComputer reports the zero-day and notes Shadowserver tracks over 5,500 internet-exposed ICS instances (count includes honeypots and potentially secured instances).
- CISA adds CVE-2026-104935 (Ivanti Connect Secure Authentication Bypass by Spoofing Vulnerability) to the Known Exploited Vulnerabilities catalog.
- Fixed Connect Secure releases (22.8R2.5, 25.1.1.2, 25.1.3.0/25.1.3.1 per secondary reporting) are made available alongside the advisory.
- Ivanti publicly discloses CVE-2026-104935 in Connect Secure via its security advisory and October 2026 security update, stating it is aware of limited exploitation in the wild at the time of disclosure; Volexity is credited with reporting the flaw.
- Previdian reports 105 exploitation attempts against CVE-2026-104935 from 50 unique source IPs in Singapore and the United States, mostly code-execution tests rather than full weaponization.
- HKCERT issues a bulletin rating CVE-2026-104935 risk Extremely High, listing remote code execution, security restriction bypass and spoofing impacts, and confirming exploitation in the wild.
- Rapid7 Exposure Command and Vulnerability Management checks for CVE-2026-104935 were reported as scheduled for this date.
- Horizon3.ai publishes research and a NodeZero rapid-response test for CVE-2026-104935.
- CISA KEV remediation due date for federal agencies (three-day window from the 2026-10-13 listing).
- Scheduled end-of-life for Connect Secure 22.7 and 22.8 release trains; migration to 25.1.3.0 requires ISA4500/ISA6500/ISA8500 platforms.
Update history for TL-2026-3420
- 2026-10-15 — CVE-2026-104935 - Ivanti Connect Secure Authentication Bypass and Remote Code Execution Exploited as Zero-Day (UTA0576): What changed No severity, exploitability, status or attribution change. Existing values (CRITICAL, ACTIVE, UTA0576, LOW confidence) are retained; the newer report's HIGH severity is not applied because that would be a downgrade. New indicat
- 2026-10-14 — Ivanti Connect Secure Authentication Bypass to Root RCE Chain (CVE-2026-104935) Exploited by UTA0576; Added to CISA KEV: What changed No field escalation. Severity (CRITICAL), exploitability (ACTIVE), status, CVSS 8.6 and low-confidence UTA0576 attribution are unchanged. Wider opportunistic exploitation is now evidenced by honeypot telemetry. New indicators (
- 2026-10-14 — Ivanti Connect Secure Zero-Day Chain (CVE-2026-104935) Actively Exploited by UTA0576: What changed No field changes. Severity, exploitability, status, CVSS score and attribution (UTA0576, LOW confidence) already match the existing record. New indicators (3) 3 minor artifacts: /etc/resolv.conf (read for DNS enumeration), the
- 2026-10-14 — Ivanti Connect Secure Authentication Bypass and Remote Code Execution Zero-Day (CVE-2026-104935) Chained by UTA0576 to Gain Root on Fully Patched Appliances: What changed Severity HIGH → CRITICAL: unauthenticated root-level RCE (chained with an unpatched privilege-escalation flaw) under confirmed active exploitation, now also rated Extremely High by HKCERT. Exploitability (ACTIVE), status, CVSS
- 2026-10-13 — Ivanti Connect Secure Authentication Bypass to Unauthenticated RCE (CVE-2026-104935) Exploited as Zero-Day by UTA0576 and Added to CISA KEV: What changed No core field escalated. Existing record already carries ACTIVE exploitability, KEV listing, the Volexity exploit chain, UTA0576 attribution (LOW confidence) and the unpatched privilege-escalation flaw. New indicators (5) 5 new
- 2026-10-13 — Ivanti Connect Secure zero-day chain (CVE-2026-104935) exploited by UTA0576 for root access on fully patched VPN appliances: What changed No whitelisted field changes (severity, exploitability, status, CVSS and attribution confidence already match the newer report). Key new fact: exploitation was a three-stage chain; stages 1-2 are CVE-2026-104935 and the stage 3
- 2026-10-13 — Ivanti Connect Secure zero-day chain exploited in the wild by UTA0576: authentication bypass and RCE (CVE-2026-104935): What changed Severity (HIGH), exploitability (ACTIVE), status and CVSS 8.6 unchanged. Exploitation window now dated: began 2026-10-03, ahead of the 2026-10-13 disclosure. Newly documented chain: spoofed X-DSCGI-PATH auth bypass, wu.cgi uplo
- 2026-10-13 — Ivanti Connect Secure Zero-Day (CVE-2026-104935) Actively Exploited for Unauthenticated Remote Command Execution: What changed No field escalation. Severity HIGH, exploitability ACTIVE, status ACTIVE, CVSS 8.6 all unchanged. Adds patch chronology (25.1.3.0 first shipped 2026-07-01; 25.1.1.2 on 2026-10-05; 22.8R2.5 on 2026-10-12), EOL of 22.7/22.8 on 20
Sources cited for Ivanti Connect Secure Authentication Bypass by Spoofing
- Ivanti warns of Connect Secure zero-day exploited in attacks
- Security Advisory Ivanti Connect Secure (CVE-2026-104935)
- Ivanti October 2026 Security Update
- CISA Known Exploited Vulnerabilities Catalog
- NVD - CVE-2026-104935
- Ivanti Connect Secure Vulnerability CVE-2026-104935 Exploited in the Wild
- CVE-2026-104935 tracking page
Detection coverage for TL-2026-3420
As of 2026-10-15, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-3420 across Splunk SPL, Microsoft KQL and Sigma, covering 49 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.