Ivanti Connect Secure Zero-Day Authentication Bypass CVE-2026-104935 Actively Exploited

On October 13, 2026, Ivanti disclosed a high‑severity authentication‑bypass zero‑day (CVE-2026-104935) affecting Ivanti Connect Secure VPN appliances. The flaw allows a remote, unauthenticated attacker to spoof authentication and execute arbitrary commands on the device. Active exploitation was observed by Volexity in early October, prompting CISA to add the vulnerability to its Known Exploited Vulnerabilities catalog the same day. Affected releases include 25.1.1.1 and prior, 25.1.2.2 and prior, and 22.8R2.4 and prior; patched versions are 25.1.1.2, 25.1.3.0, 25.1.3.1, and 22.8R2.5. Immediate out‑of‑cycle patching and IOC monitoring are required.

• Overview & Timeline

  • Vulnerability disclosed Oct 13, 2026; exploitation observed early Oct 2026.
  • CISA added CVE‑2026-104935 to KEV catalog on disclosure date.
  • Ivanti noted partial fix in July 2026 release (25.1.3.0) with backporting ongoing.
  • Historical pattern: similar zero‑day exploitation in 2024 and 2025.

• Vulnerability Mechanics

  • CWE‑290: Authentication Bypass by Spoofing.
  • CVSS v3.1 score 8.6 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L).
  • Allows unauthenticated remote attacker to bypass login and run arbitrary commands via crafted HTTP requests to the Connect Secure web portal.
  • Exploit chain leverages insufficient validation of session tokens in the authentication module.

• Exploitation & Impact

  • Volexity detected active use in the wild targeting VPN gateways; IOCs published in their GitHub repo.
  • Impact: full command execution on the appliance, enabling credential harvesting, lateral movement, and persistence.
  • Limited number of customers observed compromised; federal agencies required to patch by the following Thursday per CISA guidance.
  • No public ransomware or malware payloads disclosed; focus on direct command execution.

• Detection & Mitigation

  • Apply Ivanti patches: 25.1.1.2, 25.1.3.0, 25.1.3.1, or 22.8R2.5 immediately, outside normal cycles.
  • Monitor for IOCs from Volexity (https://github.com/volexity/threat-intel/tree/main/2026/2026-10-13%20Ivanti) and CISA KEV entry.
  • If compromise suspected, follow Ivanti recovery steps: isolate appliance, collect logs, reset credentials, and restore from known‑good backup.
  • Enforce network segmentation and MFA for VPN access as additional layers.

• Conclusion

  • CVE‑2026-104935 underscores the continued risk to VPN perimeter devices and the necessity of rapid, out‑of‑band patching for zero‑day flaws.
  • Organizations should prioritize asset inventory of Ivanti Connect Secure, enforce strict patch SLAs, and maintain continuous threat‑intel feeding for IOCs.
  • Ongoing monitoring and post‑exploitation hunting remain critical even after patch deployment.