- CVE-2026-104935 affects the listed Ivanti Connect Secure versions.
- Threat actors were exploiting the zero-day to execute arbitrary commands remotely without authentication.
- CISA added the vulnerability to its Known Exploited Vulnerabilities Catalog on Oct. 13, 2026.
CISA said on Oct. 13, 2026, that cyber threat actors were exploiting a zero-day authentication bypass in Ivanti Connect Secure appliances. The exploitation allowed remote, unauthenticated execution of arbitrary commands.
CISA said CVE-2026-104935 affects Ivanti Connect Secure versions 25.1.1.1 and prior, 25.1.2.2 and prior, and 22.8R2.4 and prior. CISA said threat actors were exploiting the vulnerability to conduct credential theft and data exfiltration.
Ivanti Connect Secure is a VPN appliance targeted in an exploit chain that Volexity identified as enabling unauthenticated remote code execution. CISA added CVE-2026-104935 to its Known Exploited Vulnerabilities Catalog on Oct. 13.
On this page
The exploit chain reached unauthenticated root-level code execution
Volexity discovered that UTA0576 repeatedly exploited the vulnerabilities starting on Oct. 3, 2026, to compromise an Ivanti Connect Secure appliance and run commands. The activity used an authentication bypass, remote code execution and privilege escalation to achieve unauthenticated root-level code execution.
The threat actor passed commands and results through HTTPS requests in the exploit chain rather than a separate command-and-control channel. Volexity said it found no backdoor or web shell on the compromised device.
Volexity began investigating suspected malicious activity at a Network Security Monitoring customer on Oct. 5, 2026. It said UTA0576 deleted evidence from Ivanti debug and Linux audit logs, so forensic analysis was needed to identify the compromise.
Patches released on Oct. 13 fixed the authentication bypass and remote code execution components, Volexity said. Ivanti was working on a fix for the privilege escalation vulnerability, which it said would be included in a future release in the coming weeks.
CISA said the Integrity Checker Tool may not detect exploitation evidence because threat actor commands execute in memory, and that organizations determining whether they were compromised will need network and memory forensics.
What to do now
- Immediately update to the latest version, as outlined in Ivanti’s Security Advisory Ivanti Connect Secure (CVE-2026-104935).
- Conduct a factory reset and upgrade the appliance to the latest version. For cloud and virtual systems, rebuild the virtual instance and upgrade to the latest version.
- Reset passwords for all accounts, including domain, administrator, and local accounts. Revoke and reissue stored certificates; reset stored API keys and license server credentials.
- Conduct network and memory forensics to identify evidence of exploitation.
FAQ
What happened with CVE-2026-104935?
CISA said cyber threat actors exploited the zero-day authentication bypass in Ivanti Connect Secure to execute arbitrary commands remotely without authentication.
Which Ivanti Connect Secure versions are affected?
CISA listed versions 25.1.1.1 and prior, 25.1.2.2 and prior, and 22.8R2.4 and prior as affected.
Has CVE-2026-104935 been exploited?
Yes. CISA said cyber threat actors were exploiting it and added it to the Known Exploited Vulnerabilities Catalog on Oct. 13, 2026.
How do organizations fix CVE-2026-104935?
CISA urged organizations to immediately update affected deployments to the latest Ivanti version. It recommended factory-resetting and upgrading compromised appliances, or rebuilding and upgrading cloud and virtual systems.
What did the Ivanti Connect Secure exploit allow attackers to do?
The vulnerability allowed remote, unauthenticated execution of arbitrary commands, while the exploit chain identified by Volexity achieved unauthenticated root-level code execution.
Sources
- CISA Urges Patching Newly Exploited Vulnerability in Ivanti Connect Secure | CISA, CISAPrimary
- A Series of Unauthenticated Events: Chained Exploitation of Ivanti Connect Secure Zero-Days, VolexityPrimary
- CISA warns of new Ivanti bug being exploited as latest Patch Tuesday breaks records, The Record
- CISA warns admins to immediately fix Ivanti flaw exploited as zero-day, BleepingComputer
How we checked this story
| Claim | Source | Status |
|---|---|---|
| CISA said CVE-2026-104935 affects Ivanti Connect Secure versions 25.1.1.1 and prior, 25.1.2.2 and prior, and 22.8R2.4 and prior. | CISA | Confirmed |
| CISA said cyber threat actors were exploiting the zero-day authentication bypass to execute arbitrary commands remotely without authentication. | CISA | Confirmed |
| Volexity identified active in-the-wild exploitation of a vulnerability chain allowing unauthenticated remote code execution in Ivanti Connect Secure VPN devices. | Volexity | Confirmed |
| CISA added CVE-2026-104935 to its Known Exploited Vulnerabilities Catalog on October 13, 2026. | CISA | Confirmed |
| BleepingComputer reported that the flaw had been exploited in zero-day attacks since at least October 1. | BleepingComputer | Attributed |
| Volexity discovered an unknown threat actor, UTA0576, abusing the exploit chain during the first week of October 2026. | Volexity | Confirmed |
| Volexity said the exploit chain combined authentication bypass, remote code execution and privilege escalation to achieve unauthenticated root-level code execution. | Volexity | Confirmed |
| Volexity began investigating suspected malicious activity at a Network Security Monitoring customer on October 5, 2026. | Volexity | Confirmed |
| Volexity said UTA0576 repeatedly exploited the vulnerabilities starting October 3, 2026, to compromise the appliance and run commands. | Volexity | Confirmed |
| Volexity said UTA0576 used the exploit channel to pass commands and did not deploy a backdoor or web shell. | Volexity | Confirmed |
| Volexity said UTA0576 deleted evidence from Ivanti debug and Linux audit logs, requiring forensic analysis to discover the compromise. | Volexity | Confirmed |
| Volexity said the authentication bypass and remote code execution vulnerabilities were tracked under CVE-2026-104935. | Volexity | Confirmed |
| Volexity said Ivanti fixed the authentication bypass and remote code execution vulnerability in patches released on October 13, 2026. | Volexity | Confirmed |
| Ivanti was still working on a fix for the privilege escalation vulnerability, according to Volexity. | Volexity | Confirmed |
| CISA said the Integrity Checker Tool may not detect exploitation evidence because threat actor commands execute in memory. | CISA | Confirmed |
| The Record said Ivanti was working with a limited number of customers exploited through the bug. | Ivanti, via The Record | Attributed |
| CISA published its report on Oct 13, 2026. | CISA | Confirmed |
| volexity.com published its report on Oct 13, 2026. | volexity.com | Confirmed |
Could not verify
- How many organizations were compromised is not established
- Whether the privilege escalation vulnerability has been assigned a separate CVE is not established
Related stories
Vulns & PatchesCollabora built-in CODE Server flaw exploited to plant web shells
Vulns & PatchesIvanti Connect Secure flaw could let attackers run commands as root
Vulns & PatchesAnyDesk Linux flaw could let attackers run root commands before approval