Ivanti disclosed CVE-2026-104935, a high-severity authentication bypass and remote code execution flaw in Ivanti Connect Secure SSL VPN appliances, and said exploitation in the wild affected a limited number of customers. The vendor had partially discovered and patched the issue in July with version 25.1.3.0, but exploitation began before the fix was backported to other supported versions. Volexity found threat actor UTA0576 using the zero-day chain in early October against appliances that were fully patched at the time. Ivanti said part of the bug was found through its LLM-assisted product security program.
CVE-2026-104935 combines authentication bypass with unauthenticated RCE.
Ivanti confirmed limited in-the-wild exploitation of Connect Secure.
A partial fix shipped in ICS 25.1.3.0 in July.
Volexity attributes the October exploit chain to UTA0576.
itical-zero-click-bugs#recipe=similar-items&sourcecontentid=7b70e2514592f68b16486d247d566d50) Patch Now: Microsoft Flags Zero-Day & Critical Zero-Click
md5
d705cceb54d730025cbc964fce146066
tch-windows-server-bug#recipe=similar-items&sourcecontentid=d705cceb54d730025cbc964fce146066) Microsoft Issues Emergency Patch for Critical Windows Ser
Full article1,908 words · extracted from darkreading.com · click to collapse
Auth Bypass to Command Execution in Ivanti Connect Secure
CVE-2026-104935 is an authentication bypass by spoofing (CWE-290) in Ivanti Connect Secure. A remote, unauthenticated attacker can spoof authentication on affected gateways and then execute arbitrary commands. Impact is high confidentiality loss with lower integrity and availability impact (CVSS 3.1 base 8.6; network, low complexity, no privileges or user interaction). It affects Connect Secure builds before 25.1.3.0 and does not affect 22.7R2.14 or earlier. CISA added it to the Known Exploited Vulnerabilities catalog on 2026-10-13 after reported zero-day attacks; ransomware use is listed as unknown, public proof-of-concept references exist, and EPSS is about 26% (98th percentile).
Do: Upgrade Ivanti Connect Secure to 25.1.3.0 or later. Builds at 22.7R2.14 and earlier are not affected. Because this is in CISA’s KEV catalog, apply the vendor’s mitigations, follow BOD 26-04 and CISA forensics-triage guidance, and treat internet-exposed appliances as potentially compromised until reviewed.
8.6
26%
KEV PoC ×2
Ivanti Connect Secure versions before 25.1.3.0, excluding 22.7R2.14 and earlier
largeon the order of 10,000–50,000 internet-exposed gateways for the product line; vulnerable-version subset unknown
CVE-2026-104935, a high-severity authentication bypass + RCE vulnerability, was only partially discovered and patched in July, leaving an opening for threat actors to capitalize on.
Rob Wright,Senior News Director,Dark Reading
October 14, 2026
5 Min Read
Source: Florencio Horcajo Alvarez via Getty Images
Even when technology vendors discover vulnerabilities before threat actors do, they can still fall victim to zero-day attacks.
That's the unfortunate situation Ivanti found itself in this week, as attackers exploited two zero-day vulnerabilities in Ivanti Connect Secure (ICS) products: a high-severity authentication bypass vulnerability and the follow-on ability for unauthenticated remote code execution (RCE) in the SSL-VPN and remote-access gateway. The cybersecurity vendor yesterday disclosed both flaws collectively as CVE-2026-104935.
"We are aware of exploitation in the wild affecting a limited number of customers at the time of disclosure," Ivanti said in its advisory.
But the situation is more complicated than your typical zero-day scenario. According to the advisory, Ivanti actually "discovered a portion of this vulnerability" in July through the vendor's product security program, and patched it with the ICS version 25.1.3.0 release. "We had been working to backport the fix to the remaining supported versions when exploitation occurred," Ivanti said.
Volexity researchers discovered that a threat actor, tracked as UTA0576, was using a zero-day exploit chain earlier this month that included CVE-2026-104935. The chain compromised ICS appliances that were fully patched at the time.
It's unclear what portion of CVE-2026-104935 Ivanti discovered over the summer, but an Ivanti spokesperson confirmed the discovery was made via Ivanti's LLM project, which uses several frontier and open source AI models to find and automatically remediate vulnerabilities in the company's products. But while AI models helped Ivanti get a head start on CVE-2026-104935, it appears threat actors were able to act even quicker.
L o a d i n g...
Multiple Zero-Days Exploited Against Ivanti ICS Instances
Volexity researchers first detected the malicious activity on Oct. 5 while investigating an incident at "a network security monitoring customer," according to a blog post published Tuesday. A forensic investigation revealed that an ICS appliance was the root cause of the attack that began on Oct. 3, and that UTA0576 used a zero-day exploit chain to compromise the device.
"This exploit chain combined an authentication bypass, a remote code execution (RCE), and a privilege escalation vulnerability to achieve unauthenticated root-level code execution" Volexity researchers wrote. "The RCE and authentication bypass vulnerabilities are tracked under CVE-2026-104935."
The privilege escalation flaw has not been disclosed. Volexity said Ivanti is currently working on a fix for the vulnerability and it will be patched in a future update.
UTA0576 actors extracted credentials from the ICS appliance and then engaged in a variety of post-compromise activities, from accessing the organization's Active Directory to deleting exploitation evidence from Ivanti debug logs. Volexity researchers said because the attack was detected and disrupted, it's unclear what UTA0576's ultimate objective was.
What is clear, according to Douglas McKee, director of vulnerability intelligence at Rapid7, are the challenges facing vendors today for not just finding vulnerabilities before attackers do, but also fully addressing them before they can be exploited.
"Finding the bug is only part of the job," he tells Dark Reading. "Ivanti found a portion of this, fixed it in the newest release back in July, and then had to carry that same fix back across every older supported version still running in the field. That backport window is exactly where this went sideways, because the fix existed but hadn't reached everywhere it needed to be by the time attackers showed up."
McKee emphasized that a quiet fix to one version could be a loud signal to attackers. "Attackers pay close attention to what a vendor changes, and an unpatched gap across supported versions is an open invitation to find the same issue somewhere the patch hasn't landed," he says.
Vendors are improving at finding their own vulnerabilities, McKee says, which is a positive development. But he stressed that the exploitation clock starts the minute any fix is released. "Closing the distance between 'we have a fix' and 'every customer has the fix' is where a lot of this risk actually lives, and to be fair, is a very hard challenge we have always faced," he says.
CVE-2026-104935: Risks & Mitigations
The Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2026-104935 to its Known Exploited Vulnerabilities (KEV) catalog on Tuesday, and gave federal civilian agencies until Oct. 16 to mitigate the flaw, either by updating to a fixed version or disabling appliances.
While CVE-2026-104935 received only a high-severity CVSS score of 8.6, McKee says the flaw is extremely serious and should be prioritized by security teams.
"What the number can't tell you is that this is already being exploited in the wild as a zero-day, it lives on an Internet-facing VPN appliance, and attackers are chaining it with a second bug," he says. "Those are the things that should be driving how fast organizations move, and together they push the practical risk well above what 8.6 reads like on paper."
Volexity researchers noted that a spoofed HTTP request with ICS's X-DSCGI-PATH internal routing header can exploit the flaw, but warned that threat actors will likely "identify additional paths that can either be used as the URL or header target for this exploit." The researchers recommended monitoring for mismatches between the URL path and X-DSCGI-PATH.
However, detecting exploitation of CVE-2026-104935 may be a challenge. While Ivanti encouraged customers to run its Integrity Checker Tool (ICT), Volexity researchers said the ICT tool may not detect modifications to a device "because this exploit chain patches library code in memory only and restores configuration store data." The threat intelligence company said network and memory forensic investigations are required to identify exploitation activity.
Rob Wright is a longtime reporter with more than 25 years of experience as a technology journalist. Prior to joining Dark Reading as senior news director, he spent more than a decade at TechTarget's SearchSecurity in various roles, including senior news director, executive editor and editorial director. Before that, he worked for several years at CRN, Tom's Hardware Guide, and VARBusiness Magazine covering a variety of technology beats and trends.
Prior to becoming a technology journalist in 2000, he worked as a weekly and daily newspaper reporter in Virginia, where he won three Virginia Press Association awards in 1998 and 1999. At TechTarget and Dark Reading, he has won several Azbee awards, including the 2026 National Silver Award for a series on vibe coding.
At Dark Reading, Rob currently covers security operations, cloud security, and Internet infrastructure. He has a keen interest in malvertising activity and the certificate authority industry, and has written extensively on both topics. He graduated from the University of Richmond in 1997 with a degree in journalism and English. A native of Massachusetts, he lives in the Boston area.
Want more Dark Reading stories in your Google search results?
Keep up with the latest cybersecurity threats, newly discovered vulnerabilities, data breach information, and emerging trends. Delivered daily or weekly right to your email inbox.
Informa TechTarget|
