Ivanti Connect Secure zero-day CVE-2026-104935 exploited in a three-flaw chain
Attackers used it from at least 3 October, ten days before Ivanti disclosed it, and the privilege escalation flaw used beside it still has no fix.
Affects
Ivanti Connect Secure
What to do
Upgrade every Connect Secure appliance to a fixed build now, then hunt for signs of compromise.
- KEV listed
- CVE
- CVE-2026-104935
- CVSS
- 8.6 (v3.0, Ivanti)
- Exploitation
- Exploited, in the CISA catalogue
- Affected
- Connect Secure 22.8R2.4 and earlier
- 25.1.2.2 and earlier
- 25.1.1.1 and earlier
- Fixed in
- 22.8R2.5
- 25.1.1.2
- 25.1.3.0
- 25.1.3.1
How the chain works
The bypass lets a remote attacker with no credentials run commands on the appliance. Volexity, which found it, reports that a group it tracks as UTA0576 chained it with two other flaws to reach root on fully patched appliances.
What to do now
Patch first, then investigate. An upgrade closes the flaw and leaves in place anything an attacker set up before it.
- Take the upgrade outside the normal patch cycle.
- Run Ivanti's Integrity Checker Tool after the upgrade. A clean result is weak evidence against this attacker.
- Review appliance and identity logs from 1 October onwards, using the indicators Volexity has published.
- Rotate credentials held on the appliance and the passwords of accounts that signed in through it.
- Apply Ivanti's fix for the privilege escalation flaw as soon as it ships.
Who is affected
NVD's record states that the 22.7R2.14 branch and earlier are not affected. CISA gave US federal agencies three days to patch.
Detection notes
Volexity reports the attacker installed no malware or web shell. It exploited the appliance again for each command, tampered with logs and stayed out of view of the Integrity Checker Tool. Logs shipped off the appliance to a central store are the record to review.
- Appliance sessions with no matching sign-in at the identity provider
- Gaps, truncation or edits in appliance logs from 1 October onwards
- Directory queries or credential use from the appliance's internal address
- New local accounts or configuration changes nobody on the team made
Essential Eight mapping
Patch applications: the Essential Eight Maturity Model sets 48 hours for internet-facing services where a working exploit exists, and this flaw is exploited. Restrict administrative privileges and multi-factor authentication limit how far credentials taken from the appliance reach inside the network.
Sources
- PrimaryCISA, Known Exploited Vulnerabilities Catalog (release 2026.10.23)Retrieved 25 Oct 2026
- PrimaryNVD, CVE-2026-104935Retrieved 25 Oct 2026
- SecondaryRapid7, Ivanti Connect Secure zero-day exploited in the wild (CVE-2026-104935)Retrieved 25 Oct 2026
- SecondaryBleepingComputer, Ivanti warns of Connect Secure zero-day exploited in attacksRetrieved 25 Oct 2026
