lee1981 (@lee1981b) on X

What it is

CVE-2026-104935 is an authentication bypass by spoofing (CWE-290) in Ivanti Connect Secure (ICS). A remote, unauthenticated attacker can run arbitrary commands. The reported entry began in the cgi-server service context. The page is a defender write-up dated 14 Oct 2026, 09:06 UTC. It is a source review, and no appliance or exploit was tested.

How it works

Public request handling and protected processing disagreed about what an unauthenticated visitor may reach. A request admitted by the public path reached protected processing and executed commands. In Volexity's reported case, commands and results travelled inside the exploit HTTPS traffic, with no separate C2 domain. No first-stage webshell or backdoor was found.

Root access in that case needed a separate escalation through another appliance component. The page says a fix for that component was being prepared on 13 Oct. Its identifier and status were not established, so don't assume it is patched or unpatched.

Preconditions / Affected

• Vector: CNA CVSS v3.1 8.6, CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L.
• Score discrepancy: The rendered Ivanti advisory prints CVSS v3.0 with the same 8.6 and vector. NVD's v3.1 metric is Secondary and attributed to the CNA.
• Not affected: 22.7R2.14 and prior, and 25.1.3.0 and later.
• EPSS: The lookup returned empty data. That means unavailable, not zero.

• Platform limits: 25.1.3 targets ISA4500/6500/8500. Existing ISA6000/8000 and virtual deployments may need migration or a new deployment, and virtual deployments need vTPM.
• Clusters: Direct 22.8R2-to-25.x cluster upgrades are unsupported. Use Ivanti's individual upgrade and cluster recreation procedure.
• Record gap: The CNA record omits 25.1.1.2 from its unaffected list, although the advisory names it. Use the vendor matrix, not a "below 25.1.3.0" rule.
• Lifecycle: 22.7/22.8 end of life is 31 Jan 2027.

What to do

1. Scope. Record every serving node's version, model, deployment type, VIP and active/standby role. Include standby and restored instances.
2. Preserve before repair. Collect via supported Ivanti/IR methods, and keep independent firewall, load-balancer, auth and directory logs, since appliance logs may have been deleted. A reboot loses runtime evidence, so record approval first.
3. Hunt. - Search retained logs for 108.165.147.64, Volexity's UTA0576 exploitation IP. A hit or a miss proves little on its own. - YARA exploit_log_ivanti_rce matches a request-context string in files or memory. It is a lead, not proof of success. - YARA exploit_py_ivanti_oct26 targets memory and the separate escalation's markers. Don't cite it as proof the entry CVE alone gives root. - The page's own YARA 4.5.8 check only compiled the rules and passed three benign controls. It did not test detection effectiveness.
4. Correlate identity. Join gateway activity to the ICS directory account's later use by account, node, destination and UTC window. Volexity saw attempts at LDAP credentials, LAPS and BitLocker data in one observed chain. Treat these as prompts, not assumed exposure.
5. Remediate. Apply the exact branch/platform fix. For suspected compromise, rotate exposed credentials through the incident owner. The recovery procedure sits behind an Ivanti login and was not reviewed.
6. Verify. Confirm the running build on every node and that old affected deployments cannot resume service. Keep the historical integrity question open separately.

Caveats

• A clean ICT result cannot clear this pattern. The activity was memory-only, configuration was restored, and selected logs were removed.
• Network restrictions were not validated as a fix.
• The page's timeline: activity reconstructed from 3 Oct and investigated from 5 Oct. The reported appliance was 22.8R2.4 build 19097 and fully patched at the time. Ivanti says part of the bug was fixed in the July 25.1.3.0 release.
• CISA added the CVE to KEV on 13 Oct with a due date of 16 Oct, which is today. KEV lists forensic triage as Yes and ransomware use as Unknown. SSVC rates exploitation active, automatable yes, technical impact total.
• The page is a third-party summary ("Made with AI"). Check the Ivanti advisory, migration guide and Volexity report for anything newer than 14 Oct.