CVE-2026-104935: Ivanti Connect Secure auth bypass exploited since Oct 3
Unauthenticated command execution on ICS VPN, privilege escalation still unpatched

CVE-2026-104935: Ivanti Connect Secure auth bypass exploited since Oct 3

Ivanti Connect Secure is under active attack through CVE-2026-104935, an authentication bypass by spoofing rated CVSS 8.6. Volexity says a threat actor it tracks as UTA0576 chained that bug with a remote code execution path and a still-unpatched privilege escalation to get unauthenticated root on a fully patched 22.8R2.4 appliance, starting 3 October 2026.

What happened

Ivanti disclosed the flaw on 13 October 2026 and said a limited number of customers were already compromised. CISA added CVE-2026-104935 to the Known Exploited Vulnerabilities catalog the same day and warned that the activity includes credential theft and data exfiltration.

Volexity's write-up is the useful one for defenders. The actor did not drop a web shell. It re-ran the exploit for each command, returned output over the same HTTPS channel, and wiped debug and audit logs. Because the privilege-escalation step patched a library in memory and then restored it, Ivanti's Integrity Checker Tool does not see the compromise. CISA said the same thing: do not treat a clean ICT result as proof you were not hit.

Post-exploitation observed by Volexity included LDAP credential dumps, LAPS passwords, BitLocker recovery keys, Kerberoasting tooling, password spraying, and packet capture of LDAP traffic from the appliance. Shadowserver is tracking more than 5,500 internet-exposed ICS instances. That count is not a victim count.

Who is affected

Ivanti lists these Connect Secure releases as affected:

  • 22.8R2.4 and earlier
  • 25.1.2.2 and earlier
  • 25.1.1.1 and earlier

Resolved versions named by Ivanti are 22.8R2.5, 25.1.1.2, 25.1.3.0, and 25.1.3.1. Version 22.7R2.14 and earlier are not affected by this specific flaw. The privilege-escalation bug used in the same chain is not fixed yet. Ivanti says that fix is coming in a later release.

What to do now

Upgrade exposed Connect Secure appliances today, then assume a clean Integrity Checker result is not enough. Prefer 25.1.1.2 or later if you can move off 22.8. If you cannot, 22.8R2.5 closes the disclosed authentication bypass and command-execution path.

If the appliance was internet-facing on an affected build on or after 1 October, take a backup, factory-reset or rebuild, restore from a known-good config, and rotate every secret that lived on or passed through it. That includes local admin passwords, domain service accounts used for LDAP, stored certificates, API keys, and license-server credentials. Then hunt from the appliance outward: unusual LDAP queries, LAPS and BitLocker attribute reads, Kerberos ticket requests, and password-spray hits against Active Directory.

Source: Volexity, A Series of Unauthenticated Events. CISA's alert is at cisa.gov.

Also on the blog

Next step: If this is on your network or a client's, ask Matthews Enterprises to check exposure.

LG webOS local-network root chain, no PIN required
pre-auth root on tested LG smart TVs from the LAN