CISA orders urgent Ivanti patch as attackers bypass auth via header

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has issued an urgent directive for organizations to update Ivanti Connect Secure appliances immediately. This action follows the disclosure of a critical zero-day vulnerability that is currently being exploited in the wild by threat actors. The agency confirmed that remote attackers are leveraging this flaw to bypass authentication and execute arbitrary commands on affected systems.

What happened

The security flaw, identified as CVE-2026-104935, carries a CVSS score of 8.6 and affects multiple versions of the Ivanti Connect Secure platform. Specifically, it impacts versions 25.1.1.1 and prior, 25.1.2.2 and prior, and 22.8R2.4 and prior. CISA stated that cyber threat actors are using this authentication bypass to conduct credential theft and data exfiltration. Consequently, the agency has added the vulnerability to its Known Exploited Vulnerabilities catalog, which requires Federal Civilian Executive Branch agencies to apply fixes by October 16, 2026.

Evidence of active exploitation has been mounting across several security firms. Previdian reported observing 105 exploitation attempts targeting its honeypot sensors as of October 14, 2026. These attacks originated from 50 unique IP addresses located in Singapore and the United States. Separately, Volexity detected the first exploitation on October 3, 2026, attributed to a previously undocumented threat actor known as UTA0576. Defused Cyber also confirmed catching pre-disclosure exploitation starting October 1, 2026, indicating that attackers were active before the public disclosure.

CISA advises that determining compromise requires network and memory forensics. If a breach is detected, the recommended response involves backing up configurations, performing a factory reset, upgrading to the latest version, and restoring the configuration. For cloud or virtual systems, rebuilding the instance is preferred. Organizations must also reset all passwords, revoke certificates, and reset API keys. CISA further cautioned that version 22.8 reaches end-of-life on January 31, 2027, urging customers to review migration guides.

How it works

The vulnerability is an authentication bypass that allows a remote, unauthenticated attacker to execute arbitrary commands. According to Yordan Ganchev, a principal threat intelligence specialist at watchTowr, the root cause is remarkably simple. A single request containing a specially crafted "X-DSCGI-PATH" header is sufficient to bypass authentication controls. This header grants access to sensitive internal functionality that should otherwise be restricted, effectively opening the door to the system without valid credentials.

Previdian founder Ryan Dewhurst explained that threat actors use this header to reach an internal CGI handler. Once access is gained, attackers upload Perl scripts disguised as ZIP files. These scripts return unique markers to confirm whether remote code execution was successful. While current payloads observed by Previdian are primarily testing for code execution rather than deploying full malware, experts warn that weaponized exploitation is likely to follow rapidly. The simplicity of the exploit mechanism means it can be easily automated and scaled.

Volexity researchers noted that the threat actor UTA0576 combined this vulnerability with a privilege escalation flaw to achieve unauthenticated root-level code execution. Unlike typical attacks that leave behind persistent malware or web shells, this actor re-exploited the device for every command executed. They actively tampered with logs and removed temporary artifacts to evade detection tools, including Ivanti's Integrity Checker Tool. This fileless approach makes traditional forensic analysis more challenging, as there are fewer static indicators of compromise left on the disk.

Key details

• Vulnerability ID: CVE-2026-104935 with a CVSS score of 8.6.
• Affected Versions: Ivanti Connect Secure 25.1.1.1 and prior, 25.1.2.2 and prior, and 22.8R2.4 and prior.
• Exploit Mechanism: Authentication bypass via a crafted "X-DSCGI-PATH" header leading to remote code execution.
• Active Threats: Observed by Previdian, Volexity, and Defused Cyber since early October 2026.
• Threat Actor: UTA0576, assessed as criminally motivated, uses fileless techniques and log tampering.
• Federal Deadline: FCEB agencies must patch by October 16, 2026.

Why it matters

For software engineers and IT leads, this incident highlights the persistent risk posed by complex network appliances. Ivanti Connect Secure has a history of vulnerabilities, with this issue joining 14 others on the CISA KEV list. The speed at which exploitation moved from targeted attacks to broader scanning suggests that mass exploitation is imminent. Organizations relying on these appliances for remote access face immediate risks of credential theft and lateral movement within their networks. The fact that the exploit is simple and fileless means that standard endpoint protection may not detect the initial breach.

The operational impact is significant because remediation is not just a simple patch application. CISA’s recommendation for a factory reset and configuration restore indicates that the integrity of the existing installation cannot be trusted once compromised. This process introduces downtime and operational friction, requiring careful planning. Furthermore, the need to reset all credentials and reissue certificates implies a broad security overhaul for any affected organization. Engineers must prioritize forensic investigation to ensure no backdoors remain, as the attackers deliberately concealed their activities.

What you can do

• Immediately update Ivanti Connect Secure appliances to the latest patched version.
• Scan network logs for inbound requests containing the "X-DSCGI-PATH" header.
• Conduct memory and network forensics to identify signs of exploitation if patching was delayed.
• If compromise is suspected, perform a factory reset, upgrade, and restore configuration from backup.
• Reset all user, administrator, and domain passwords, and reissue stored certificates and API keys.
• Review Ivanti’s Upgrade and Migration Compatibility Guide, especially for users of version 22.8.