Auth Bypass to Command Execution in Ivanti Connect Secure
CISA: Ivanti Connect Secure Authentication Bypass by Spoofing Vulnerability
CVSS 3.1
8.6high
EPSS
26%p98
Published
()
KEV added
AI analysis
CVE-2026-104935 is an authentication bypass by spoofing (CWE-290) in Ivanti Connect Secure. A remote, unauthenticated attacker can spoof authentication on affected gateways and then execute arbitrary commands. Impact is high confidentiality loss with lower integrity and availability impact (CVSS 3.1 base 8.6; network, low complexity, no privileges or user interaction). It affects Connect Secure builds before 25.1.3.0 and does not affect 22.7R2.14 or earlier. CISA added it to the Known Exploited Vulnerabilities catalog on 2026-10-13 after reported zero-day attacks; ransomware use is listed as unknown, public proof-of-concept references exist, and EPSS is about 26% (98th percentile).
What to do: Upgrade Ivanti Connect Secure to 25.1.3.0 or later. Builds at 22.7R2.14 and earlier are not affected. Because this is in CISA’s KEV catalog, apply the vendor’s mitigations, follow BOD 26-04 and CISA forensics-triage guidance, and treat internet-exposed appliances as potentially compromised until reviewed.
Affected
Ivanti Connect Secure
versions before 25.1.3.0, excluding 22.7R2.14 and earlier
Estimated exposure
largeon the order of 10,000–50,000 internet-exposed gateways for the product line; vulnerable-version subset unknown — Ivanti Connect Secure (formerly Pulse Secure) VPN appliances are widely deployed in enterprises and government and have historically shown on the order of tens of thousands of internet-exposed instances in public scans; only the window…
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description
Authentication bypass by spoofing in ICS before version 25.1.3.0 allows a remote unauthenticated attacker to execute arbitrary commands. This does not impact ICS version 22.7R2.14 or prior.
CISA Known Exploited Vulnerability
Affected
Ivanti Connect Secure
Required action
Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
CISA says attackers are exploiting Ivanti Connect Secure zero-day CVE-2026-104935 to steal credentials.
CISA added CVE-2026-104935 to the Known Exploited Vulnerabilities catalog on October 13, 2026, after attackers used an Ivanti Connect Secure zero-day for remote authentication bypass and command execution. Volexity says unknown actor UTA0576 began exploitation on October 3 against version 22.8R2.4, chaining an auth bypass, file-upload code execution, and a separate privilege-escalation flaw to gain root. Attackers collected stored domain credentials, queried Active Directory, sought local administrator passwords and BitLocker recovery keys, and conducted password spraying and network discovery. Ivanti fixed the bypass and code-execution issue on October 13; the privilege-escalation fix was still in development. CISA says patching alone is insufficient and recommends factory reset or rebuild plus rotation of passwords, certificates, API keys, and license credentials.
Actively exploited Ivanti Connect Secure flaw CVE-2026-104935 lets unauthenticated attackers bypass authentication and run commands.
CVE-2026-104935 is an unauthenticated authentication-bypass and remote code execution flaw in Ivanti Connect Secure, scored CVSS 3.1 8.6. Inconsistent URL checks and an attacker-controlled header let requests reach protected CGI scripts; attackers then abuse a wu.cgi file-write issue, and observed intrusions used a separate privilege escalation to reach root. Ivanti confirmed exploitation of a limited number of customers. CISA added the CVE to the KEV catalog on October 13, 2026, citing credential theft and data exfiltration; Volexity traced activity to at least October 3. Fixed releases are 25.1.1.2, 25.1.3.0 or 25.1.3.1, and 22.8R2.5.
CISA says patch Ivanti Connect Secure CVE-2026-104935, exploited as a zero-day for unauthenticated command execution.
CISA warned administrators to immediately patch CVE-2026-104935, a high-severity authentication bypass in Ivanti Connect Secure exploited as a zero-day since at least October 1. Unauthenticated attackers can run arbitrary commands; Volexity says actor UTA0576 chained the issue with remote code execution and privilege escalation for unauthenticated root access, then stole Active Directory secrets including LAPS passwords and BitLocker recovery keys. Ivanti shipped fixes in versions 22.8R2.5, 25.1.3.0, 25.1.3.1, and 25.1.1.2 and reported limited in-the-wild exploitation. CISA added the flaw to its exploited-vulnerability list and ordered federal agencies to remediate by Friday, while Shadowserver tracks more than 5,600 internet-exposed ICS hosts.
Volexity found UTA0576 chaining three Ivanti Connect Secure zero-days for unauthenticated root and credential theft.
Volexity tied suspicious activity on a customer’s Ivanti Connect Secure 22.8R2.4 appliance to UTA0576, present since at least October 3, 2026. The actor chained an authentication bypass, race-condition remote code execution, and privilege escalation—bypass and RCE tracked as CVE-2026-104935—to obtain unauthenticated root without persistent disk changes that Ivanti’s Integrity Checker would flag. The actor then harvested LAPS passwords, BitLocker keys, and plaintext directory attributes, captured LDAP traffic, and conducted Kerberoasting and password spraying while clearing selected logs. Ivanti patched two flaws on October 13; the escalation fix remains pending, and CISA added CVE-2026-104935 (CVSS 8.6) to the KEV catalog.
Ivanti patched CVE-2026-104935 after UTA0576 chained flaws to root on Connect Secure VPN appliances.
Ivanti released fixes on October 13, 2026, for CVE-2026-104935, a Connect Secure zero-day exploited before a patch existed. Volexity, which found the activity during an incident investigation, tracks the attacker as UTA0576. The actor chained three vulnerabilities to go from an unauthenticated web request to root-level code execution on an ICS VPN appliance running 22.8R2.4.
CISA put actively exploited Ivanti Connect Secure flaw CVE-2026-104935 on KEV, with federal fixes due October 16.
CISA urged immediate updates after confirming exploitation of CVE-2026-104935, a CVSS 8.6 authentication bypass in Ivanti Connect Secure 25.1.1.1 and earlier, 25.1.2.2 and earlier, and 22.8R2.4 and earlier, allowing remote unauthenticated command execution. The flaw is in the Known Exploited Vulnerabilities catalog, with a October 16, 2026 fix deadline for federal civilian agencies. Previdian reported 105 honeypot attempts from 50 IPs in Singapore and the United States. Volexity first saw exploitation on October 3 by criminal actor UTA0576, which paired it with privilege escalation for root execution, stole VPN credentials and limited Active Directory data, used Kerberoasting, and tampered with logs without deploying malware. Defused Cyber reported pre-disclosure exploitation from October 1.
Attackers exploited Ivanti Connect Secure CVE-2026-104935 to bypass login and run commands; CISA added it to KEV.
Attackers without their own accounts logged into Ivanti Connect Secure appliances through an authentication-bypass flaw and then ran arbitrary commands. Ivanti tracks the issue as CVE-2026-104935 with a CVSS score of 8.6; it affects Connect Secure 22.8R2.4 and earlier plus specified 25.1 releases, while versions 22.7 and earlier are unaffected. Fixes include 22.8R2.5, 25.1.1.2, 25.1.3.0, and 25.1.3.1. Ivanti said exploitation occurred while backports were still underway, watchTowr described spoofing of identity signals, Volexity published exploitation details, and CISA added the flaw to its KEV catalog on October 13.
Attackers chained three Ivanti Connect Secure zero-days for root access; one privilege-escalation flaw remains unpatched.
Volexity said attacker UTA0576 chained three Ivanti Connect Secure zero-days to run commands as root without authentication, starting October 3 on one fully patched 22.8R2.4 appliance. CVE-2026-104935, rated CVSS 8.6, covers the authentication bypass and remote code execution; the privilege-escalation flaw remains unpatched. The attacker stole stored LDAP credentials, searched Active Directory, and password-sprayed accounts while evading Ivanti's Integrity Checker Tool. Ivanti reported limited exploitation, and CISA marked it active with total technical impact. Separate CVSS 9.9 flaws CVE-2026-106042 and CVE-2026-109412 in Xtraction and Neurons Patch for Intune are not known to be exploited.
Ivanti Connect Secure zero-day CVE-2026-104935 is exploited for unauthenticated remote command execution.
Ivanti disclosed CVE-2026-104935, a CVSS 8.6 authentication-bypass vulnerability in Ivanti Connect Secure that lets a remote, unauthenticated attacker execute arbitrary commands. Ivanti and CISA say exploitation occurred before disclosure against a limited number of customers, and CISA added the flaw to the Known Exploited Vulnerabilities catalog the same day. Volexity reported related activity detected in early October and said the actor also used a still-unpatched privilege-escalation vulnerability. Patches are available in 25.1.1.2, 25.1.3.0, 25.1.3.1, and 22.8R2.5; versions 22.7.x and below are unaffected. Rapid7 advises emergency patching and hunting for compromise because reliable vendor indicators were not available at disclosure.
Attackers are exploiting an Ivanti Connect Secure zero-day for unauthenticated commands, credential theft, and data exfiltration.
CISA says threat actors are exploiting CVE-2026-104935, a zero-day authentication bypass in Ivanti Connect Secure, to run arbitrary commands without authentication and to steal credentials and exfiltrate data. Affected releases are 25.1.1.1 and earlier, 25.1.2.2 and earlier, and 22.8R2.4 and earlier. The flaw was added to the KEV Catalog on Oct. 13, 2026. CISA warns Ivanti's Integrity Checker Tool may miss exploitation because commands run in memory, and recommends backup, factory reset or virtual rebuild, upgrade, and rotation of passwords, certificates, API keys, and licenses. Version 22.8 reaches end of life on Jan. 31, 2027.
Ivanti Connect Secure zero-day CVE-2026-104935 was exploited before patching, and CISA added it to KEV.
Volexity found threat actor UTA0576 chaining three zero-days in Ivanti Connect Secure to bypass authentication, execute code remotely, and escalate privileges, with the earliest confirmed exploitation on Oct. 1. Ivanti patched the authentication-bypass and remote-code-execution path as high-severity CVE-2026-104935, a flaw it had partly discovered internally in June but deferred because it was not then being exploited. A limited number of customers were compromised; the actor stole credentials stored on the appliance, dumped Active Directory metadata, deployed custom tools, tampered with logs, and conducted network reconnaissance. CISA added the defect to its Known Exploited Vulnerabilities catalog and warned that Ivanti's Integrity Checker Tool may miss commands that run only in memory.
Ivanti disclosed CVE-2026-104935, a high-severity authentication bypass and remote code execution flaw in Ivanti Connect Secure SSL VPN appliances, and said exploitation in the wild affected a limited number of customers. The vendor had partially discovered and patched the issue in July with version 25.1.3.0, but exploitation began before the fix was backported to other supported versions. Volexity found threat actor UTA0576 using the zero-day chain in early October against appliances that were fully patched at the time. Ivanti said part of the bug was found through its LLM-assisted product security program.
Ivanti patched Connect Secure zero-day CVE-2026-104935 after UTA0576 used it for remote command execution.
Ivanti released Connect Secure updates for CVE-2026-104935, an 8.6-rated authentication bypass that lets unauthenticated remote attackers run arbitrary commands. Ivanti said a limited number of customers were exploited before backports were finished; Volexity tracks the previously unknown criminal actor as UTA0576. Observed activity included credential theft, data exfiltration, log tampering, and network reconnaissance using built-in appliance commands, without malware or web shells. A separate privilege-escalation bug is not covered by this CVE, and Ivanti expects a fix in the coming weeks.
CISA added actively exploited Windows Shell flaw CVE-2026-96951 to the KEV catalog.
CISA added Microsoft Windows Shell flaw CVE-2026-96951, CVSS 8.8, to the Known Exploited Vulnerabilities catalog. Microsoft's October 2026 updates addressed a reported 1,415 vulnerabilities, including this command-injection bug, which can bypass Mark of the Web when a user opens a crafted file from email or messaging or follows a malicious link. Microsoft confirmed active exploitation, and federal agencies must fix it by October 16, 2026. CISA also added Ivanti Connect Secure authentication-bypass CVE-2026-104935, CVSS 8.6, which can let an unauthenticated remote attacker run commands on affected versions before 25.1.3.0.
CISA added exploited Ivanti Connect Secure CVE-2026-104935 to KEV, with a federal deadline of October 16.
CISA added Ivanti Connect Secure CVE-2026-104935, an authentication-bypass flaw scored CVSS 8.6, to the Known Exploited Vulnerabilities catalog. Versions before 25.1.3.0 let a remote unauthenticated attacker execute arbitrary commands; 22.7R2.14 and earlier are unaffected. Ivanti said exploitation has hit a limited number of customers. Federal agencies must remediate by October 16, 2026.
Canada flags Ivanti flaws after CISA added Connect Secure CVE-2026-104935 to the KEV catalog.
On October 13, 2026, the Canadian Centre for Cyber Security warned of vulnerabilities in Ivanti Connect Secure, Ivanti Xtraction, and Ivanti Neurons Patch for Intune. Connect Secure versions 25.1.1.1 and prior, 25.2.2 and prior, and 22.8R2.4 and prior are affected; CISA added CVE-2026-104935 to the Known Exploited Vulnerabilities catalog the same day. Xtraction 2026.2.1 and earlier has multiple CVEs, and Neurons Patch for Intune versions before September 16, 2026 are tied to CVE-2026-109412. Administrators are urged to review Ivanti advisories and patch.
CISA added actively exploited Microsoft Windows and Ivanti Connect Secure flaws to the KEV catalog.
CISA added two vulnerabilities to the Known Exploited Vulnerabilities Catalog after finding evidence of active exploitation. They are CVE-2026-96951, a Microsoft Windows command-injection vulnerability, and CVE-2026-104935, an Ivanti Connect Secure authentication-bypass-by-spoofing vulnerability. Binding Operational Directive 26-04 requires federal civilian agencies to prioritize remediation of KEV entries on publicly exposed assets that can give total control. CISA also urges other organizations to patch cataloged flaws first.
Talos says 2026 CVE volume passed 70,000 while KEV growth lagged, so discovery is not exploitation.
Cisco Talos’s Threat Source newsletter argues that record CVE volume is not a zero-day apocalypse. By late September 2026, published CVEs had passed 70,000 and were up 105% year over year, while CISA KEV grew 37%; CVEs from 2025 or earlier still made up 33% of KEV, and networking-gear CVEs rose to 27%. The same edition flags UAT-6275 espionage against CIS government and critical infrastructure using macro documents, GitHub scripts, and a WinRAR flaw, plus headlines on CVE-2026-104935 in Ivanti Connect Secure and an actively attacked maximum-severity SonicWall SMA SSRF.