Key points
- CISA added CVE-2026-104935 to the Known Exploited Vulnerabilities catalog on October 13, 2026.
- Ivanti released updates for Connect Secure versions 22.8R2.5, 25.1.1.2, 25.1.3.0, and 25.1.3.1.
- Volexity found evidence of a threat actor chaining three zero-days to gain root access on patched appliances.
Ivanti Connect Secure versions 25.1.1.1 and prior, 25.2.2 and prior, and 22.8R2.4 and prior are affected by CVE-2026-104935. The Canadian Centre for Cyber Security noted these vulnerabilities in its October 13, 2026 advisory. CISA added this CVE to its Known Exploited Vulnerabilities catalog on the same date. Ivanti has released updates for versions 22.8R2.5, 25.1.1.2, 25.1.3.0, and 25.1.3.1. A separate privilege escalation issue remains unpatched.
In plain English
CVE-2026-104935 is a high-severity authentication bypass that allows a remote attacker to execute arbitrary commands without logging in. According to Security Affairs, the flaw is caused by spoofing in Ivanti Connect Secure versions before 25.1.3.0. Versions 22.7R2.14 and earlier are not affected by this specific issue. Ivanti confirmed the vulnerability was exploited in attacks in the wild.
The background
Volexity discovered the exploitation while investigating an incident at a customer, according to SecurityWeek. The threat actor, tracked as UTA0576, chained three zero-day vulnerabilities to gain root access on a fully patched appliance. CVE-2026-104935 covers two of these flaws: the authentication bypass and a remote code execution bug. The third vulnerability, a privilege escalation issue, remains unpatched.
What changes now
CISA ordered federal agencies to fix the flaw by October 16, 2026, according to Security Affairs. The agency added CVE-2026-104935 to the KEV catalog on October 13, 2026. Volexity reported evidence of exploitation starting on October 3. The attackers stole domain credentials, exfiltrated Active Directory metadata, and searched for LAPS passwords and BitLocker recovery keys. No backdoor or web shell was found on the device.
Who needs to act first
Teams usually prioritize systems exposed to the public internet or untrusted networks. Check whether your Ivanti Connect Secure appliances are accessible from outside your corporate firewall. Apply the available updates immediately to address the authentication bypass and remote code execution flaws. Test the updates in a non-production environment first to ensure compatibility with your configurations. Back up appliance configurations before making changes. Monitor logs for signs of unauthorized access or credential theft while waiting for the vendor to patch the remaining privilege escalation issue.
What to do and how to stay safe: Ivanti Connect Secure
- Verify if any Ivanti Connect Secure appliances are running versions prior to 25.1.3.0 or 22.8R2.5.
- Apply the latest available updates from Ivanti to address CVE-2026-104935 and the associated remote code execution bug.
- Monitor network traffic and appliance logs for unusual activity, such as credential harvesting or configuration changes.
- Restrict administrative access to Ivanti appliances to trusted networks until all vulnerabilities are patched.
Step-by-step guide: Out-of-Band Patches: Meaning, Risks, and Deployment Reality
General security guidance from the Patch Herald newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Which Ivanti products are affected by this advisory?
Ivanti Connect Secure versions 25.1.1.1 and prior, 25.2.2 and prior, and 22.8R2.4 and prior are affected, according to the Canadian Centre for Cyber Security.
Is there a fix for the privilege escalation vulnerability?
No fix has been confirmed yet for the privilege escalation issue; Ivanti plans to fix it over the coming weeks, according to SecurityWeek.
When did CISA add this CVE to its catalog?
CISA added CVE-2026-104935 to the Known Exploited Vulnerabilities catalog on October 13, 2026.
