CVE-2026-104935

Name of the Vulnerable Software and Affected Versions Ivanti Connect Secure versions 25.1.1.1 through 25.1.2.2 Ivanti Connect Secure versions 22.8 through 22.8R2.4

Description An authentication bypass and remote code execution (RCE) issue exists that allows a remote unauthenticated attacker to execute arbitrary commands. This is part of a three-flaw chain used by threat actor UTA0576 to achieve root-level access. The authentication bypass occurs via the /dana-na/auth/url default/welcome.cgi endpoint by spoofing the X-DSCGI-PATH header to point to the wu.cgi handler. The RCE is achieved through a race condition in wu.cgi where a Perl script with a .zip extension is temporarily written to /home/runtime/tmp/<MD5(filename)> before being deleted, allowing a window for execution. A third privilege escalation flaw, which manipulates the in-memory copy of libdsplibs.so to redirect maintenance tasks to the Perl interpreter, is used to gain root privileges. This specific memory-only modification allows the attack to evade the Ivanti Integrity Checker Tool. Real-world exploitation began on October 3, 2026, targeting Active Directory credentials, LAPS passwords, and BitLocker recovery keys. The attacker used custom Python scripts (such as ml.py, rq5.py, mk.py, rr.py, sp run.py, and h.py) and a renamed tcpdump binary dsstatmond located in /data/.icscap/ to capture plaintext LDAP, HTTP, FTP, and Telnet traffic.

Recommendations For Ivanti Connect Secure 25.1 versions 25.1.1.1 through 25.1.2.2, upgrade to version 25.1.1.2 (for ISA6000 or ISA8000) or 25.1.3.0 or later (for ISA4500, ISA6500, or ISA8500). For Ivanti Connect Secure 22.8 versions 22.8 through 22.8R2.4, upgrade to version 22.8R2.5 or migrate to version 25.1.1.2 or later. At the moment, there is no information about a newer version that contains a fix for the privilege escalation component of this chain. Restrict access to the /dana-na/auth/url default/welcome.cgi endpoint or monitor for requests containing X-DSCGI-PATH headers pointing to wu.cgi or /home/runtime/tmp/ paths as a mitigation measure.