Ivanti Discloses Actively Exploited Connect Secure VPN Zero-Day Flaw

Ivanti disclosed an actively exploited zero-day authentication bypass vulnerability (CVE-2026-104935) carrying an 8.6 CVSS score in its Connect Secure VPN platform. In the first week of October 2026, cybersecurity firm Volexity discovered an unknown threat actor tracked as UTA0576 chaining the authentication bypass with remote code execution and privilege escalation flaws to achieve unauthenticated root-level code execution on a fully patched version 22.8R2.4 appliance. According to Volexity, the attacker is targeting Local Administrator Password Solution (LAPS) passwords and BitLocker recovery keys, while CISA added the flaw to its Known Exploited Vulnerabilities catalog following reports of credential theft and data exfiltration. Exposure management firm watchTowr noted that a single request containing a specially crafted "X-DSCGI-PATH" header is sufficient to bypass authentication, making CVE-2026-104935 the 15th Ivanti Connect Secure or Pulse Connect Secure vulnerability added to CISA's KEV catalog. The flaw impacts versions 25.1.1.1 and prior, 25.1.2.2 and prior, and 22.8R2.4 and prior, with patches released in versions 25.1.1.2, 25.1.3.0, 25.1.3.1, and 22.8R2.5 while versions 22.7.x and below remain unaffected. "The root cause of the vulnerability is incredibly simple, with a single request containing a specially crafted ‘X-DSCGI-PATH’ header being all that is needed to bypass authentication and access sensitive functionality that otherwise should be restricted." — Yordan Ganchev, Principal Threat Intelligence Specialist at watchTowr.