/Vulnerability Library

Ivanti Connect Secure <= 22.8R2.4 - Authentication Bypass via X-DSCGI-PATH Header

CVE-2026-104935
Early Release

Description

Ivanti Connect Secure VPN appliances contain an authentication bypass vulnerability in how the appliance routes requests from front- and back-end processes to CGI script handlers. The URL path is used to determine whether a request is allowed (welcome.cgi is public), while the X-DSCGI-PATH header determines the actual destination of the request. An attacker can send a request to the unauthenticated welcome.cgi endpoint with an X-DSCGI-PATH header pointing to an authenticated CGI script such as wu.cgi, bypassing authentication entirely. This vulnerability is chained with a file write race condition in wu.cgi and a privilege escalation via dsinvoked DSCache trust to achieve unauthenticated root-level remote code execution.

Severity

Critical

CVSS Score

10

Affected Product

connect_secure

Published Date

October 14, 2026

Template Author

volexity, dhiyaneshdk

CVE-2026-104935.yaml
10.0Score

CVSS Metrics

CVSS Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
CVE ID:
cve-2026-104935
CWE ID:
cwe-306

References

https://www.volexity.com/blog/2026/10/13/a-series-of-unauthenticated-events-chained-exploitation-of-ivanti-connect-secure-zero-days/https://forums.ivanti.com

Remediation Steps

Upgrade Ivanti Connect Secure to the patched version released on October 13, 2026. Affected versions include 25.1.1 and prior, 25.1.2, and 22.8R2.4.