Ivanti disclosed an actively exploited Ivanti Connect Secure zero-day, CVE-2026-104935, on 13 October 2026. CISA added it to its Known Exploited Vulnerabilities catalogue the same day and set a federal remediation deadline of 16 October 2026. The patch closes two flaws in the attack chain; a third remains unfixed.
What the Flaw Is and What Attackers Did With It
CVE-2026-104935 is an authentication bypass by spoofing, classified as CWE-290, with a CVSS v3.0 score of 8.6, that lets an unauthenticated attacker run arbitrary commands on the appliance. Ivanti Connect Secure is the company’s remote-access VPN gateway, used by organisations to let staff reach internal systems from outside the network.
The vulnerability was found by Volexity, a Washington-based incident response firm, which published its research on 13 October 2026. Volexity attributes the activity to a previously unknown actor it designates UTA0576, and says its assessment of a criminal rather than espionage motive is low confidence.
What makes the case unusual is the attacker’s discipline. According to Volexity, UTA0576 planted no web shell, no backdoor and no malware. It instead re-ran the exploit for every single command, passing instructions and results through ordinary HTTPS requests, and found no persistence mechanism was needed.
Once inside, the actor went after credentials rather than data on the appliance itself. Volexity records theft of stored LDAP domain credentials, then use of a service account to query Active Directory for LAPS local administrator passwords, BitLocker recovery keys and other password-bearing attributes, followed by Kerberoasting and password spraying.
It also cleaned up behind itself, removing entries from the appliance debug log and the audit log, deleting its own scripts and restoring the configuration data it had altered.
Which Versions Are Affected and What to Upgrade To
Three code lines are affected, and each has its own fixed build.
| Affected version | Upgrade to |
|---|---|
| 25.1.1.1 and earlier | 25.1.1.2 |
| 25.1.2.2 and earlier | 25.1.3.0 or 25.1.3.1 |
| 22.8R2.4 and earlier | 22.8R2.5 |
| 22.7.x and below | Not affected |
Two points are worth care here. Volexity notes that 22.8R2.4, Build 19097, was the newest available release when the attacks were running — meaning fully updated appliances were being compromised. And the vulnerability database VulDB has published an entry listing 22.7R2.14 as a fixed version, which contradicts Ivanti’s own statement that the 22.7 line is not affected at all. Ivanti’s advisory is the authority on that point.
Ivanti’s advisory says that “at the time of disclosure, Ivanti is aware of limited exploitation in the wild”. The exposure is larger than the confirmed victim count: Shadowserver, which scans the internet for exposed systems, tracks more than 5,500 reachable Connect Secure instances, as reported by BleepingComputer, though how many are patched or are honeypots is unknown.
Why Patching Does Not Close the Whole Chain
The 13 October patch fixes two of the three flaws UTA0576 used, and the third has no fix and no CVE identifier.
CVE-2026-104935 covers both the authentication bypass and a remote code execution flaw caused by a race condition in the file upload handler. The third component is a privilege escalation weakness in the way an internal broker process trusts configuration data, and it is what turns code execution into root access.
Volexity states that Ivanti is working on a fix for the privilege escalation vulnerability and expects it in a future release, described as coming in the coming weeks. Until then, patching removes the attacker’s route in but leaves the escalation step available to anyone who finds another way to reach it.
This is the same pattern seen three weeks ago, when NetScaler zero-days were patched but administrators were told to check for compromise first.
Why the Integrity Checker Tool Will Say You Are Clean
Ivanti’s own Integrity Checker Tool does not detect this compromise, and Ivanti’s advisory nonetheless recommends running it regularly.
The reason is technical but matters for anyone relying on the result. The exploit patches the appliance’s library code only in the running process memory, never on disk, and it restores the configuration store entry it modifies once it is finished. Volexity puts it flatly: “the tool does not detect any modifications”.
A clean Integrity Checker result is therefore not evidence that an appliance was not attacked. Volexity says network and memory forensics are required instead. Ivanti has not published its own indicators of compromise.
What to Do Now
Treat this as emergency work rather than part of the next patch cycle; Rapid7’s guidance is to apply the update outside normal schedules.
- Identify every Connect Secure appliance in the estate and record its exact build number, not just its version family.
- Upgrade each one to the fixed build for its code line using the table above.
- Do not treat the upgrade as the end of the job, and do not rely on a clean Integrity Checker Tool result.
- Hunt for the indicators below in appliance logs and on disk, and preserve a memory image before rebooting anything you suspect.
- Assume credential exposure if you find anything: rotate LDAP service account passwords, review LAPS and BitLocker key access in Active Directory, and look for Kerberoasting and password-spraying activity on domain controllers.
- Federal agencies in the United States must meet CISA’s due date of 16 October 2026, which also carries forensic triage requirements and an instruction to stop using the product if mitigations are unavailable.
What to Look For on a Suspect Appliance
Volexity published a specific set of indicators, and the most reliable of them is a header mismatch no legitimate request produces.
- Header mismatch: Requests to the public welcome.cgi page carrying an X-DSCGI-PATH header that points somewhere else, such as the wu.cgi upload script.
- Dropped scripts: Files in the temporary directory named ml.py, rq5.py, mk.py, rr.py, sp_run.py, spray_hits.json or pu.txt.
- Hidden capture directory: A .icscap directory containing packet capture files and a script named h.py.
- Renamed packet sniffer: A running process called dsstatmond, which is tcpdump under another name.
- Log gaps: Missing entries in the appliance debug log and the system audit log, which is itself a sign rather than an absence of one.
- Infrastructure: Connections to the host 108.165.147.64, a rented virtual server Volexity says ran an OpenVPN service between 30 September and 7 October 2026.
What Is Still Unknown
As of 14 October 2026, Ivanti has patched the authentication bypass and the remote code execution, CISA requires federal agencies to act by 16 October 2026, and the privilege escalation flaw has neither a patch nor a CVE number.
- Victim count: Ivanti says exploitation was limited but has given no number, and no victim organisations have been named.
- Start date: Volexity’s earliest confirmed exploitation is 3 October 2026. The threat intelligence service Defused told BleepingComputer it first saw activity on 1 October, which is not independently confirmed.
- Who the actor is: UTA0576 is newly designated and unattributed, and even the criminal-versus-espionage question is held at low confidence.
- Ransomware involvement: CISA’s catalogue entry records ransomware use as unknown.
- Escalation patch date: No date has been given beyond “the coming weeks”.
Ivanti’s track record on this product is part of the context: Connect Secure has been the subject of repeated exploited zero-days since January 2024. For comparison with how quickly other vendors’ flaws reach the catalogue, see the Atlassian flaw exploited within hours that was not added to CISA KEV, and the Cisco ISE deadline set for 19 September.
Frequently Asked Questions
What Is CVE-2026-104935?
It is an authentication bypass by spoofing in Ivanti Connect Secure, scored 8.6 on CVSS v3.0, that allows an unauthenticated attacker to execute arbitrary commands on the appliance. Ivanti disclosed it on 13 October 2026 as a zero-day already under exploitation.
Is the Ivanti Connect Secure Zero-Day Fully Patched?
No. The 13 October update fixes the authentication bypass and the remote code execution, but the privilege escalation flaw used in the same attack chain has no patch and no CVE identifier. Ivanti says a fix will arrive in a future release.
Which Ivanti Connect Secure Versions Are Affected?
Versions 25.1.1.1 and earlier, 25.1.2.2 and earlier, and 22.8R2.4 and earlier. The fixed builds are 25.1.1.2, 25.1.3.0 or 25.1.3.1, and 22.8R2.5 respectively. Ivanti says the 22.7 line and below are not affected.
Will the Integrity Checker Tool Detect This Compromise?
No. The exploit modifies library code only in memory and restores the configuration data it changes, so Volexity reports the tool finds no modifications. Network and memory forensics are needed instead.
What Is the CISA Deadline for CVE-2026-104935?
CISA added the vulnerability to its Known Exploited Vulnerabilities catalogue on 13 October 2026 with a due date of 16 October 2026 for United States federal agencies.
