CVE-2026-104935: Ivanti VPN Flaw and Patch Guide

Attackers got there first. On October 13, 2026, Ivanti disclosed CVE-2026-104935 and confirmed that a limited number of customers had already been hit. The flaw sits in Ivanti Connect Secure (ICS), the company’s SSL VPN gateway, and it lets a remote attacker with no credentials run commands on the appliance. If you run ICS, treat the update as an emergency change, not something for the next patch cycle.

Below you’ll find the affected versions, the fixed releases and what Volexity learned from its investigation. You’ll also see why installing the update may not finish the job. Volexity reports that the attacker erased evidence and slipped past Ivanti’s own Integrity Checker Tool, so a clean scan does not prove a clean appliance.

Quick Answer

CVE-2026-104935 is an actively exploited authentication bypass in Ivanti Connect Secure, scored CVSS 8.6, that allows unauthenticated command execution. Ivanti lists 22.8R2.5, 25.1.1.2, 25.1.3.0 and 25.1.3.1 as resolved versions. Upgrade first, then hunt for compromise, because Volexity says the attackers tampered with logs. A related privilege escalation flaw used in the same attack chain is still unpatched.

What Happened

Ivanti published its advisory on October 13, 2026, and Rapid7 reports that CISA added the flaw to its Known Exploited Vulnerabilities (KEV) catalog the same day. The timeline has a wrinkle. Ivanti says its own product security team found part of the problem earlier and fixed it in version 25.1.3.0, released in July 2026. Attackers moved while the company was still backporting that fix to other supported releases.

Volexity found and reported the attacks. It says a previously unknown actor it tracks as UTA0576 began exploiting the chain on October 3. Threat intelligence company Defused says it saw the first signs of Ivanti zero-day exploitation two days earlier, on October 1, according to BleepingComputer.

Vulnerability Facts at a Glance

Scoring sources can disagree. VulDB, for example, publishes its own 10.0 rating for this entry. CyberInfos uses the 8.6 figure reported from Ivanti’s advisory and recommends checking the NVD entry for later changes.

Affected and Fixed Versions

Ivanti’s advisory, as summarized by Rapid7, lists these versions:

Ivanti says the 22.7 branch and earlier are not affected. Some third-party databases disagree and list 22.7R2.13 as vulnerable. Read Ivanti’s advisory directly before you decide that a 22.7 appliance is safe.

According to BleepingComputer, Shadowserver counts more than 5,500 ICS instances reachable from the internet. It is unclear how many are honeypots or already updated.

How the Attack Chain Works

Volexity documented three separate flaws chained together. Ivanti tracks the first two under CVE-2026-104935.

1. Authentication bypass. The appliance checks the requested URL to decide whether a login is needed, but a request header decides which script actually handles the request. An attacker can ask for the public login page while steering the request to a protected script. This Ivanti VPN authentication bypass is what removes the credential requirement.
2. Remote code execution. An upload handler writes a file to disk before checking whether it is valid, which leaves a brief window in which the attacker can run it. The result is code execution as a low-privileged service user.
3. Privilege escalation. A privileged background service trusts configuration data that the low-privileged account can alter in memory, which lets the attacker run commands as root.

The third flaw is not covered by the October 13 fix, Volexity says. The actor also skipped the usual tooling. It sent commands and results through the exploit’s own HTTPS requests, deployed no backdoor or web shell, and re-ran the whole chain for every command.

Why one CVE does not explain the root compromise

By Volexity’s account, CVE-2026-104935 covers the authentication bypass and the code execution flaw. The jump to root depends on a separate privilege escalation bug. Pinning the whole root-level compromise on one CVE would overstate what the evidence shows.

What the attacker did next

Volexity says UTA0576 spent its time on credentials and reconnaissance. Observed actions included:

• extracting credentials stored on the appliance, including domain credentials used for LDAP;
• querying Active Directory for LAPS local administrator passwords and BitLocker recovery keys;
• deploying a custom Kerberos tool capable of Kerberoasting, and password spraying against Active Directory accounts;
• capturing LDAP traffic on the appliance to harvest credentials;
• collecting appliance configuration data and authentication logs; and
• deleting entries from Ivanti debug logs and Linux audit logs.

Two of Volexity’s judgments deserve a caveat. It assesses with low confidence that the actor is criminally motivated rather than state-sponsored, and with medium confidence that it used large language models to develop exploits. Neither is an established fact. And because the operation was disrupted, Volexity could not determine the actor’s final goal.

Why Patching Alone May Not Be Enough

Applying the fix closes the unauthenticated entry path. It does not tell you whether someone is already inside. Four problems stand out:

• The Integrity Checker misses it. The exploit patches library code in memory and restores configuration data afterward, so Ivanti’s file-based Integrity Checker Tool sees nothing unusual, according to Volexity.
• The logs were edited. The payload removed recent entries from the debug log and the audit log.
• There may be nothing to find on disk. With no web shell or implant, forensics depends on memory images, core dumps and network evidence.
• Stolen credentials survive the update. Anything the attacker copied stays valid until you rotate it.

This is not a new problem. A February 2024 joint advisory from CISA, the FBI and international partners warned that attackers could deceive Ivanti’s Integrity Checker Tool and hide compromise on Connect Secure appliances. As Volexity describes it, the 2026 chain defeats the tool again.

CyberInfos analysis: because the root-escalation flaw is still unpatched, any other route to code execution on an updated appliance could in principle reach root. That is a risk assessment, not a reported attack, but it justifies tighter monitoring until Ivanti ships its fix.

Emergency Response Checklist

Work through these steps in order. The first three should not wait for the rest.

• Inventory every ICS appliance. Include disaster-recovery, lab and branch units, and record each build number.
• Capture evidence quickly. If you can, collect memory and disk images before updating, because a reboot erases in-memory artifacts. Do not let this delay patching for long. This is CyberInfos guidance, not vendor advice.
• Apply the CVE-2026-104935 patch. Move to 22.8R2.5, 25.1.1.2, 25.1.3.0 or 25.1.3.1 as appropriate, following Ivanti’s advisory.
• Hunt for the exploit pattern. Volexity recommends watching for bursts of requests to the appliance’s welcome.cgi login script and for any mismatch between the requested URL and the X-DSCGI-PATH header.
• Check for leftover tooling. Volexity found attacker scripts in /tmp and a hidden /data/.icscap directory. Compare what you find with the indicators on Volexity’s GitHub page.
• Look for lateral movement. Investigate connection attempts that originate from the appliance, including LDAP queries and failed logins spread across many accounts.
• Rotate credentials if compromise is possible. Start with the Active Directory service account the appliance uses for LDAP, then other secrets stored on it. CyberInfos also recommends reviewing LAPS passwords and BitLocker recovery keys, since the actor searched for them.
• Follow Ivanti’s recovery steps for 22.8 and 25.x releases if you find evidence of compromise.
• Watch for the next fix. Ivanti says the privilege escalation patch will arrive in a future release.

What Indian Organizations Should Know

CERT-In’s April 2022 directions under Section 70B(6) of the IT Act require covered entities to report listed cyber incidents within six hours of noticing them. If you confirm unauthorized access through a compromised VPN appliance, check whether the event falls under those directions. If it does, the clock is already running. At the time of writing, CyberInfos had not located a CERT-In advisory specific to this flaw, so watch CERT-In’s site for updates. This is not legal advice.

CyberInfos Analyst Insight

Beyond the immediate patch, three points matter.

• Treat the VPN gateway as a credential store. The Ivanti VPN authentication bypass supplied the foothold, and directory credentials were the actor’s focus, so a suspected compromise is an identity incident as much as a device incident.
• The pattern is not new. Ivanti zero-day exploitation has recurred for years. BleepingComputer reports that CISA has flagged 36 Ivanti vulnerabilities as exploited since November 2021, and Rapid7 notes earlier Connect Secure zero-days in 2024 and 2025.
• Branch lag creates exposure. With this Ivanti Connect Secure zero-day, the July fix reached one release line first, and other branches stayed exposed while backports were built. Staying on the newest supported branch narrows that gap.

FAQ

What is CVE-2026-104935?
It is a high-severity flaw in Ivanti Connect Secure that lets an unauthenticated remote attacker bypass authentication and run commands. Ivanti disclosed it on October 13, 2026, and confirmed limited exploitation before disclosure.

How widespread is the exploitation?
Ivanti describes it as limited and says it affected a small number of customers. Volexity’s report covers one investigated victim, but more than 5,500 appliances are reachable from the internet, so the true scale is unknown.

Which versions fix the flaw?
Ivanti lists 22.8R2.5, 25.1.1.2, 25.1.3.0 and 25.1.3.1. Per the vendor, the 22.7 branch and earlier are not affected.

Does patching remove an attacker who is already inside?
No. The update blocks the entry path but does not reverse stolen credentials, and Volexity says the Integrity Checker may not detect the intrusion.

Is the privilege escalation flaw fixed?
Not as of Volexity’s October 13 report, and it is separate from the fix for CVE-2026-104935. Ivanti says a fix will come in a future release, so check its advisory for updates.

Final Thoughts

Patch first, then investigate. The Ivanti Connect Secure zero-day gives unauthenticated attackers a route to run commands, and at least one organization was compromised before a fix reached its release line. Apply the CVE-2026-104935 patch to every appliance today. Then hunt for the behaviors Volexity describes, rotate directory credentials where compromise is possible, and keep watching Ivanti for the remaining privilege escalation fix.