Ivanti fixes actively exploited vulnerability in Connect Secure
Ivanti released fixes for CVE-2026-104935 in Connect Secure after confirming limited exploitation. CISA added the vulnerability to its Known Exploited Vulnerabilities catalog.
Ivanti Connect Secure CVE-2026-104935 is an actively exploited vulnerability affecting selected versions of Ivanti Connect Secure VPN appliances. Ivanti disclosed it on October 13 and confirmed limited exploitation in the wild. The U.S. agency CISA has since added the vulnerability to its Known Exploited Vulnerabilities (KEV) catalog.
According to CISA, a remote unauthenticated attacker can execute arbitrary commands. Ivanti released fixes for the affected 25.x and 22.x product branches on October 25 and recommended that administrators update immediately.
Ivanti Connect Secure in a zero-day vulnerability chain
Researchers at Volexity documented an attack in which a chain of three previously unknown vulnerabilities was used against a fully updated Ivanti Connect Secure appliance. According to their analysis, CVE-2026-104935 covers authentication bypass and remote code execution.
In the observed case, the chain ultimately led to code execution with root privileges. According to Ivanti and Volexity, a separate vulnerability enabling privilege escalation to root is still awaiting a fix. Deploying the CVE-2026-104935 patch therefore cannot be considered a substitute for examining an appliance that may have been compromised before the update.
During the incident, Volexity observed credential theft, Active Directory reconnaissance, data exfiltration, and attempts to cover the attacker’s tracks. The company identifies the monitored actor as UTA0576 and cites possible criminal motivation; however, this is its attribution, not an independently confirmed finding.
Why a VPN gateway vulnerability is serious
Connect Secure functions as a remote access point to corporate networks. A vulnerability on an internet-exposed VPN appliance can therefore give an attacker a path to internal systems without requiring a valid user account.
Adding CVE-2026-104935 to the KEV catalog means that CISA has recorded its exploitation. The catalog serves as a list of vulnerabilities for which administrators should prioritize remediation in light of confirmed attacker activity.
What administrators should do
- Verify whether their Ivanti Connect Secure deployment is among the affected versions in the 25.x or 22.x branches.
- Deploy Ivanti’s fix for CVE-2026-104935 according to the vendor’s security advisory.
- If unauthorized access is suspected, conduct a forensic examination of the appliance and related systems.
- Monitor the release of a fix for the separate privilege-escalation vulnerability to root and any possible CVE identifier assignment.
Volexity warns that the Integrity Checker tool alone may not detect a compromise. The campaign’s scope, the number of affected organizations, and the attacker’s identity have not been publicly confirmed. Alongside updating, administrators should therefore monitor new indicators of compromise and further confirmed exploitation cases.
Sources
- Ivanti – Ivanti confirms limited exploitation in the wild, urges immediate updating, and links to the security advisory.
- CISA Known Exploited Vulnerabilities Catalog – CISA lists CVE-2026-104935 as an actively exploited vulnerability and notes the possibility of unauthenticated remote command execution.
- Volexity – Volexity’s forensic analysis describes a three-part chain, exploitation against a fully updated ICS, and the attacker’s observed subsequent activity.
- SecurityWeek – Independently corroborates that exploitation of the chain gave attackers root access even on an updated VPN appliance.
Verified and updated: October 14, 2026 06:19
