CVE-2026-104935 - PatchNow

📋 Vulnerability Details

Data Source: CIRCL

Confidence: HIGH

Exploitation Method: DIRECT_NETWORK

CVE Published: 2026-10-13

Added to CISA KEV: 2026-10-13 0 DAY BETWEEN CVE AND KEV

🎯 Recommendations:

CRITICAL — IMMEDIATE PATCH: Upgrade Ivanti Connect Secure to version 25.1.3.0 or later (on ISA4500/6500/8500 appliances), or to 22.8R2.5 / 22.7R2.14 for applicable legacy branches. This is a zero-day with confirmed active exploitation — patching must be treated as an emergency change.
CRITICAL — ACTIVE EXPLOITATION: This vulnerability has been exploited in the wild by threat actor UTA0576. Before and after patching, conduct a thorough Indicators of Compromise (IoC) review. Check for unauthorized admin accounts, unexpected outbound connections, web shell artifacts, modified system files, and anomalous VPN session logs.
IMMEDIATE — THREAT HUNT: Engage threat hunting or incident response capabilities to determine if the appliance has already been compromised. Ivanti's Integrity Checker Tool (ICT) should be run immediately if available for your version.
NETWORK SEGMENTATION: While patching is in progress, consider temporarily restricting access to the VPN management interface by source IP allow-listing if operationally feasible, to reduce the attack surface.
MONITORING: Enable enhanced logging on the appliance and forward logs to SIEM immediately. Alert on: unauthenticated requests to authenticated endpoints, unexpected command execution patterns, new admin account creation, and unusual outbound network connections from the appliance.
PATCH PRIORITY: CRITICAL — treat as Priority 1 emergency patch. Given active zero-day exploitation, confirmed RCE, no authentication requirement, and the internet-facing nature of the product, this should be patched within 24-48 hours of awareness, not within a standard patch cycle.
POST-PATCH: Rotate all credentials that may have transited the VPN appliance, including VPN user credentials, certificates, and any secrets stored on or accessible through the appliance. Assume credential exposure if compromise cannot be ruled out.
VENDOR ADVISORY: Monitor the Ivanti Security Advisory at https://hub.ivanti.com/s/article/Security-Advisory-Ivanti-Connect-Secure-CVE-2026-104935 for updated guidance, additional IoCs, and any supplementary patches.

🔍 Web Intelligence (Kagi · 2026-10-13)

Summary

CVE-2026-104935 is a critical authentication bypass by spoofing vulnerability affecting Ivanti Connect Secure VPN appliances ^[4]^[5]. The flaw allows a remote attacker to forge the signals the appliance uses to verify user identity, effectively deceiving the device into treating an unauthorized request as coming from a trusted, already logged-in user ^[4]. This is a high-priority concern as it facilitates unauthenticated remote code execution, posing a severe threat to the integrity and confidentiality of impacted networks ^[1]^[3].

Exploitation

Active Exploitation: The vulnerability has been actively exploited in the wild ^[1]^[3].
Threat Actors: Exploitation has been attributed to the threat actor identified as UTA0576 ^[1].
Availability: Technical details confirm it is part of a zero-day exploit chain; public proof-of-concept or exploit tools have been reported in the context of active campaigns ^[1].
Attack Prerequisites: The attack is low-complexity, requiring only remote network access. It does not require user interaction or pre-existing authentication to execute arbitrary commands ^[3].

Affected Products & Patches

Affected Versions: The vulnerability impacts versions of Ivanti Connect Secure up to and including 22.8R2.4 ^[1].
Patch Availability: Ivanti has released updates to resolve the issue. Versions 25.1.3.0 and later (running on ISA4500, ISA6500, or ISA8500 appliances) are confirmed not to contain this vulnerability ^[2].
Mitigation: Administrators are strongly advised to upgrade to the latest available version to secure their appliances against this and other potential threats ^[2].

Impact

Access & Capability: Successful exploitation grants an unauthenticated remote attacker the ability to execute arbitrary commands at the root level on the target appliance ^[1].
Business Risk: For internet-facing deployments, this vulnerability represents a critical risk, as it allows attackers to completely compromise the VPN gateway, potentially leading to unauthorized lateral movement into internal corporate networks, data exfiltration, and full persistent control over network infrastructure ^[1].

Sources

CVE-2026-104935 - Exploits & Severity - Feedly
A critical vulnerability affecting Ivanti Connect Secure VPN appliances allows unauthenticated root-level remote code execution through a zero-day exploit chain that includes authentication bypass and privilege escalation components. Exploited by the threat actor UTA0576 and patched on October 13, 2…
Security Advisory Ivanti Connect Secure (CVE-2026-104935)
25.1.3.0 (released July 2026 and running on ISA4500, ISA6500 or ISA8500) or later do not contain this vulnerability. We always recommend customers upgrade their solution to the latest version to benefit from important security enhancements and features.
Ivanti warns of Connect Secure zero-day exploited in attacks
Remote threat actors without privileges can exploit CVE-2026-104935 in low-complexity attacks that don't require user interaction to execute arbitrary commands on targeted ICS appliances.
Ivanti Connect Secure FAQ: CVE-2026-104935 | watchTowr
CVE-2026-104935 is an Authentication Bypass by Spoofing vulnerability in Ivanti Connect Secure. It lets a remote attacker forge the signals the device uses to confirm a user’s identity, so the device treats a forged request as if it came from a trusted, already logged-in user.
CVE-2026-104935: Ivanti Connect Secure Vulnerability
CVE-2026-104935 is an Authentication Bypass by Spoofing vulnerability in Ivanti Connect Secure that lets a remote attacker run commands without logging in. Update to the resolved version for the affected branch now.

🔴 CVE-2026-104935