Ivanti Connect Secure Zero-Day CVE-2026-104935 Was Exploited for 10 Days Before Patches

An unauthenticated attacker who can reach an Ivanti Connect Secure appliance can run commands on it through CVE-2026-104935, a flaw Ivanti disclosed on October 13 after attackers had used it for at least 10 days.

The fixed builds are 22.8R2.5, 25.1.3.0, 25.1.3.1 and 25.1.1.2. Patching narrows the attack but does not close it: Ivanti has not yet fixed a privilege escalation flaw that Volexity says the attacker chained with this one, according to Rapid7 and BleepingComputer.

CVE-2026-104935: what an attacker needs

The flaw is an authentication bypass by spoofing (CWE-290) in the Connect Secure SSL VPN gateway. Rapid7 lists a CVSS v3.0 score of 8.6 with the vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L. That means network reach, no credentials, no user interaction and no special conditions.

The score understates the incident. A base score describes one flaw, and Volexity says the attacker combined an authentication bypass, a remote code execution flaw and a privilege escalation flaw to reach unauthenticated root-level execution on fully patched devices. Ivanti says versions 22.7.x and below are unaffected.

Affected build (and earlier)	Fixed build
22.8R2.4	22.8R2.5
25.1.1.1	25.1.1.2
25.1.2.2	25.1.3.0, 25.1.3.1

Timeline from July 2026 to October 14

• July 2026: Ivanti ships 25.1.3.0, which it says contains part of the fix after its internal product security program found the problem, per Rapid7.
• October 1: Defused reports the first signs of exploitation, per BleepingComputer.
• October 3: Volexity says exploitation by a group it tracks as UTA0576 began at least on this date.
• October 13: Ivanti discloses the flaw and releases patches. CISA adds CVE-2026-104935 to its Known Exploited Vulnerabilities catalog the same day.
• October 14: CISA tells all network defenders to patch and check for compromise.

Rapid7 says exploitation happened while Ivanti was backporting the July fix to other supported versions. Ivanti describes the exploitation as limited and says it is working directly with affected organisations.

Why patching does not settle it

Volexity says UTA0576 deployed no malware and no web shell. According to BleepingComputer, the group re-exploited the device for each command and tampered with logs, which lets it evade Ivanti's Integrity Checker Tool. Ivanti says it has no reliable indicators of compromise to offer. Volexity has published some on GitHub.

The attacker went after Active Directory credentials, LAPS passwords and BitLocker recovery keys, BleepingComputer reports. A compromised VPN gateway therefore puts the domain at risk, not only the appliance.

CISA's instructions for compromised appliances

CISA added the flaw under Binding Operational Directive 26-04, which covers Federal Civilian Executive Branch agencies only. BleepingComputer says those agencies must act "by Friday", which it does not tie to a calendar date.

For an appliance that may be compromised, CISA says to back up the configuration, factory reset and upgrade (rebuilding cloud and virtual instances), then restore the configuration. It then calls for resetting domain, administrator and local passwords, reissuing stored certificates, and resetting stored API keys and license server credentials. CISA also said the Integrity Checker Tool may not detect the activity, so compromised organisations need network and memory forensics.

Ivanti's record in CISA's catalog

Shadowserver tracked more than 5,500 internet-exposed Connect Secure instances in BleepingComputer's October 13 report and more than 5,600 the next day. Neither count says how many are patched or are honeypots.

CISA has listed 36 Ivanti vulnerabilities as exploited since November 2021, and 12 of them have been used in ransomware attacks.

1. Listed as exploited36 CVEs
2. Used in ransomware12 CVEs

Source: BleepingComputer, October 13, 2026, citing CISA

Connect Secure has been here before: CVE-2023-46805 and CVE-2024-21887 in January 2024, CVE-2025-0282 in January 2025 and CVE-2025-22457 in March 2025. Related coverage on this site includes the Atlassian Data Center flaw that CISA also catalogued and a failed patch at Ahsay.

Neither Rapid7 nor BleepingComputer reports a date for the missing privilege escalation patch, and neither names its CVE.