OTX-6acf8533a44062761084826c
info
📛 Threat Title
Ivanti CVE-2026-104935: Zero-Day Chain Exploited in Operation Innovate
Description
Ivanti has released emergency security updates after attackers exploited a chain of three zero-day vulnerabilities in Connect Secure VPN appliances to gain root-level access without authentication. The attack began on October 3, targeting an appliance running version 22.8R2.4. Two vulnerabilities are tracked as CVE-2026-104935 with a CVSS score of 8.6, involving an authentication bypass and remote code execution through manipulated CGI requests and malicious file uploads. A third unpatched vulnerability allows privilege escalation to root by manipulating a privileged service through memory modification. While patches address the authentication bypass and RCE, the privilege escalation flaw remains unresolved. CISA added the vulnerability to its KEV catalog with an October 16 remediation deadline for federal agencies. Pulse contains 2 indicator(s) (IOCs). View on OTX to inspect.
Indicators of Compromise (2)
Each indicator is enriched from the IOC database, threat-intel feed corroboration (Threat Hunt) and VirusTotal. Click one to expand.
cve
CVE-2026-104935
IOC database
- Type
- cve
- Value
CVE-2026-104935- First seen
- Last seen
- Attached to this threat
- Appears in
- 4 threats
- Description
- Ivanti Connect Secure Authentication Bypass by Spoofing Vulnerability
Threat Hunt — feed corroboration
Not present in any configured threat-intel feed.
Details From VirusTotal
No VirusTotal details cached for this IOC. Open the IOC page to query VirusTotal.
ipv4
108.165.147.64
VT 6 / 92
IOC database
- Type
- ipv4
- Value
108.165.147.64- First seen
- Last seen
- Attached to this threat
- Appears in
- 1 threat
Threat Hunt — feed corroboration
Not present in any configured threat-intel feed.
Flagged by 6 of 92 VirusTotal vendors
| Vendor | Verdict | Detection |
|---|---|---|
| Fortinet | malicious | malware |
| MalwareURL | malicious | malware |
| SOCRadar | malicious | malicious |
| alphaMountain.ai | suspicious | suspicious |
| Criminal IP | suspicious | suspicious |
| GreyNoise | suspicious | suspicious |
Details From VirusTotal
Basic Properties
| Network | 108.165.147.0/24 |
| Country | HK |
| AS owner | Evoxt Sdn. Bhd. |
| ASN | 149440 |
| Regional registry | APNIC |
History
| Last analysis | 2026-10-15 23:28 UTC |
| Last modified on VirusTotal | 2026-10-16 01:04 UTC |
| WHOIS record date | 2026-09-30 12:07 UTC |
References (2)
- reference AlienVaulkt OTX
-
OTX pulse
AlienVaulkt OTX
Ivanti has released emergency security updates after attackers exploited a chain of three zero-day vulnerabilities in Connect Secure VPN appliances to gain root-level access without authentication. The attack began on October 3, targeting an appliance running version 22.8R2.4. Two vulnerabilities are tracked as CVE-2026-104935 with a CVSS score of 8.6, involving an authentication bypass and remote code execution through manipulated CGI requests and malicious file uploads. A third unpatched vulne
Remediations (10)
-
web:cybersecuritynews.com
Ivanti has disclosed an actively exploited zero-day vulnerability in Ivanti Connect Secure (ICS) that allows remote attackers to execute arbitrary commands without logging in . Tracked as CVE-2026-104935 , the flaw carries a high-severity CVSS score of 8.6.
-
web:hub.ivanti.com
Ivanti has released updates for Ivanti Connect Secure (ICS) which addresses one high severity vulnerability. Successful exploitation could allow a remote unauthenticated attacker to execute arbitrary commands.
-
web:op-c.net
Ivanti Connect Secure zero-day CVE-2026-104935 is actively exploited . Learn how attackers gained root access, affected versions, and recommended fixes.
-
web:securityarsenal.com
CVE-2026-104935 in Ivanti Connect Secure is on CISA's KEV with confirmed in -the-wild exploitation. Unauthenticated RCE on your VPN gateway demands immediate action.
-
web:socprime.com
CVE-2026-104935 is an actively exploited vulnerability in Ivanti Connect Secure that covers an authentication bypass and remote code execution chain . Attackers can manipulate request-routing behavior to access a protected CGI handler without authentication and exploit temporary file handling to execute malicious code as the cgi-server account. In observed attacks, this was combined with a ...
-
web:socradar.io
Ivanti released fixes on October 13, 2026 , for CVE-2026-104935 , an Ivanti Connect Secure zero-day that attackers exploited before a patch existed. Volexity, which uncovered the activity during an incident investigation, tracks the attacker as UTA0576. According to the published analysis, the actor ...
-
web:www.rapid7.com
On October 13, 2026 , Ivanti published a security advisory for CVE-2026-104935 , a high-severity authentication bypass by spoofing (CWE-290) affecting Ivanti Connect Secure (ICS). The vulnerability has a CVSSv3.0 score of 8.6 and allows a remote, unauthenticated attacker to execute arbitrary commands.
-
web:www.securityweek.com
Ivanti on Tuesday warned customers that a zero-day vulnerability in its Connect Secure (ICS) VPN appliances has been exploited in the wild. Tracked as CVE-2026-104935 and rated high severity, the issue is an authentication bypass that lets a remote, unauthenticated attacker execute arbitrary commands.
-
web:www.volexity.com
Volexity has identified three zero-day exploits in Ivanti Connect Secure VPN appliances exploited by a previously unknown threat actor that Volexity tracks as UTA0576. This exploit chain combines authentication bypass, RCE, and privilege escalation vulnerabilities to grant unauthenticated root-level RCE. The authentication bypass and RCE vulnerabilities are tracked under CVE-2026-104935 ...
-
web:www.waterisac.org
ACTION MAY BE REQUIRED for utilities using affected Ivanti Connect Secure appliances. Utilities that outsource technology support should consult their service providers for assistance with remediation actions. CVE-2026-104935 is an actively exploited , high-severity authentication-bypass vulnerability in Ivanti Connect Secure. The flaw enables a remote attacker with no credentials to execute ...
AI Forensic Analysis
Only Available for Registered Users. Sign in to view.