Ivanti Connect Secure Zero-Day Exploited: Patch and Investigate Now

Actively exploited VPN zero-day

Ivanti has released fixes for CVE-2026-104935, a high-severity Connect Secure authentication-bypass vulnerability that can let a remote, unauthenticated attacker execute arbitrary commands. Ivanti and CISA confirm exploitation in the wild.^[1][2]

Reporting cutoff: 2026-10-13T19:17:55Z

Who is affected—and which releases fix it

Ivanti’s model-specific table gives four distinct paths: releases through 22.7R2.14 and earlier are not affected; affected 22.8 deployments through 22.8R2.4 should move to 25.1.1.2 or later, or install 22.8R2.5 if immediate migration is not possible; ISA6000 and ISA8000 appliances on 25.1.1 through 25.1.1.1 should update to 25.1.1.2; and affected 25.1.2 through 25.1.2.2 deployments should update to 25.1.3.0 or 25.1.3.1 as applicable to the platform. Supported ISA4500, ISA6500 and ISA8500 systems on 25.1.3.0 or later are not affected by this CVE.^[1]

The CVE record describes the issue as authentication bypass by spoofing in Connect Secure before 25.1.3.0, while specifically noting that 22.7R2.14 and prior are not affected. It scores the vulnerability 8.6 High with a network-accessible, low-complexity, no-privileges-required vector.^[3]

What happened

Volexity says it began investigating suspicious activity on October 5 and traced it to exploitation that started on October 3 against an appliance running 22.8R2.4—the current fully patched release at the time. The observed chain combined authentication bypass and remote code execution tracked as CVE-2026-104935 with a separate privilege-escalation flaw, producing unauthenticated root-level execution.^[4]

Ivanti says it had already fixed a portion of the vulnerability in 25.1.3.0 and was backporting that work when exploitation occurred. Fixed supported releases are now available, and Ivanti reports that a limited number of customers were known to be affected at disclosure.^[1]

Volexity reports that the separate privilege-escalation flaw was still awaiting a future fix at the reporting cutoff. That distinction matters: the October 13 updates address CVE-2026-104935, but patching alone does not prove that a previously exposed device was never compromised.^[4]

Immediate response checklist

1. Confirm exposure. Identify every Connect Secure appliance, including standby, disaster-recovery and externally managed instances. Record the appliance model, exact version, build and Internet exposure before changing anything.^[1]
2. Contain urgently while preserving evidence in parallel. If compromise is suspected, use qualified incident response to limit attacker access without unnecessarily destroying volatile or historical evidence. Retain available configuration, logs, alerts, network telemetry and supported forensic captures where feasible; do not let collection delay urgent isolation when active harm is occurring.^[2][4]
3. Follow Ivanti’s supported update path. Install the applicable fixed release, respecting prerequisites, backups and model-specific guidance. Verify the running version after the maintenance window—not merely the downloaded package name.^[1]
4. Assume credentials reachable from the appliance may be exposed until investigated. Volexity observed theft or targeting of LDAP/domain credentials, LAPS passwords, BitLocker recovery keys and other directory data. Coordinate credential rotation with incident responders so evidence collection and recovery do not work against each other.^[4]
5. Hunt beyond the appliance. Review identity, Active Directory, DNS, authentication and endpoint telemetry for password spraying, unusual queries, lateral movement or activity originating from the VPN gateway.^[4]
6. Validate service after remediation. General practical guidance: test authentication, MFA, directory integration, certificates, routing and remote access. Confirm from the live appliance that the intended fixed release is running, and ensure obsolete nodes or restored snapshots have not reintroduced a vulnerable build.^[1]

Why the built-in integrity check may not be enough

Volexity reports that the attacker executed commands through repeated exploitation, used memory-resident stages, restored altered state and removed selected log entries. It did not observe a first-stage backdoor or web shell on the investigated device. Because the chain could avoid persistent on-disk modifications, Volexity warns that the Ivanti Integrity Checker Tool may not identify compromise; network and memory forensics may be required.^[4]

CISA’s KEV entry independently marks forensic triage as required under BOD 26-04. The federal remediation due date is October 16, 2026; that deadline applies to the federal directive, but every organization operating an exposed appliance should use the KEV listing as an urgent prioritization signal.^[2]

Safe monitoring clues

Volexity recommends monitoring for unusually large numbers of requests to the public Connect Secure login route and for mismatches between the requested URL path and the internal CGI path named by a request. It also recommends checking temporary storage for post-exploitation artifacts and using network and memory forensics when compromise is suspected.^[4]

General practical guidance: do not probe systems you do not own or administer, and do not run public exploit code against production. If you see suspicious activity, contain urgently while preserving volatile evidence where feasible, and involve qualified incident response before destructive cleanup. This ordering follows CISA’s forensic-triage requirement and Volexity’s warning that disk-only checks can miss the observed activity.^[2][4]

Bottom line

If your organization runs Ivanti Connect Secure, check the exact model and release immediately. Apply Ivanti’s supported fixed version, but do not stop at patching if the appliance was exposed during the exploitation window. Preserve evidence, investigate the gateway and adjacent identity systems, rotate potentially exposed credentials under an incident-response plan, and verify the corrected live runtime.^[1][2][4]

Sources

1. Ivanti security advisory: Ivanti Connect Secure (CVE-2026-104935)
2. CISA Known Exploited Vulnerabilities catalog entry for CVE-2026-104935
3. CVE Program record: CVE-2026-104935
4. Volexity: A Series of Unauthenticated Events—Chained Exploitation of Ivanti Connect Secure Zero-Days

Editorial note: This article separates the vendor’s product guidance, CISA’s federal remediation requirement and Volexity’s incident findings. It does not provide exploit instructions.