Key points
- CISA added CVE-2026-104935 to the KEV catalog on 13 October 2026.
- The flaw allows unauthenticated remote code execution on Ivanti Connect Secure.
- Attackers used a chain of three zero-days to steal credentials and exfiltrate data.
The Cybersecurity and Infrastructure Security Agency added CVE-2026-104935 to its Known Exploited Vulnerabilities catalog on 13 October 2026. This high-severity authentication bypass in Ivanti Connect Secure allows remote, unauthenticated attackers to execute arbitrary commands on the appliance, granting them significant control over the network perimeter device.
Volexity discovered active exploitation of this vulnerability while investigating an incident involving a previously undocumented threat actor tracked as UTA0576. The attackers chained three separate zero-day flaws to achieve unauthenticated, root-level code execution on a fully patched Ivanti Connect Secure appliance, demonstrating that standard patching alone was insufficient against this specific attack chain.
Threat actor tactics and goals
The threat actor focused primarily on credential theft, data exfiltration, network reconnaissance, and log tampering. According to Volexity, the attackers stole domain credentials stored on the appliance and exfiltrated limited Active Directory metadata. They used custom tools to search for LAPS passwords and BitLocker recovery keys within the directory, expanding their reach beyond the initial compromise point.
The group also conducted password-spraying attacks and tested credentials using a custom Kerberos tool. They attempted to extract credentials from captured network traffic, scanned the network, and collected appliance configuration data. Volexity noted that the attackers parsed authentication logs to identify valid usernames, though no backdoor or web shell was found on the device during the investigation.
Affected versions and vendor response
Ivanti confirmed that the vulnerability was exploited in the wild, affecting a limited number of customers at the time of disclosure. The vendor has released updates for Ivanti Connect Secure versions 22.8R2.5, 25.1.1.2, 25.1.3.0, and 25.1.3.1 to address the authentication bypass and remote code execution bugs. However, a third privilege escalation vulnerability in the chain remains unpatched, with the vendor planning to fix it in the coming weeks.
As Payload Report reported on 9 October 2026, federal agencies were previously mandated to address critical flaws in document server software and Apache Struts. This new addition to the KEV catalog brings Ivanti Connect Secure into that same urgent remediation category for federal entities under Binding Operational Directive 22-01.
What happens next
CISA orders federal agencies to fix the Ivanti Connect Secure flaw by 16 October 2026. The Canadian Centre for Cyber Security encourages users and administrators to review provided web links and apply necessary updates as they become available. Experts recommend that private organizations also review the catalog and address these vulnerabilities in their infrastructure to protect against similar exploitation campaigns.
Why this attack works
This incident highlights the risk of vulnerability chaining, where attackers combine multiple flaws to bypass security controls. Teams usually see initial access achieved through an authentication bypass, followed by privilege escalation to gain administrative rights. Check whether your monitoring detects unusual command execution or credential access on network appliances. Verify that your detection rules cover lateral movement techniques such as password spraying and directory searches, as attackers often pivot quickly after gaining initial footholds.
Background: Authentication bypass vulnerabilities
Authentication bypass flaws rarely stem from weak passwords. They typically arise from logic errors in how applications process identity tokens, session states or internal trust boundaries. Misconceptions about where these vulnerabilities hide lead teams to overlook critical server-side validation gaps and trust assumptions that attackers exploit to gain unauthorised access.
Read the full guide: Authentication Bypass Myths: What Security Teams Get Wrong
What to do and how to stay safe: Ivanti
- Inventory all Ivanti Connect Secure appliances and verify their current version numbers against the affected list.
- Apply the latest vendor patches for ICS versions 22.8R2.5, 25.1.1.2, 25.1.3.0, and 25.1.3.1 as soon as possible.
- Monitor authentication logs for unusual activity, such as mass login attempts or access from unexpected sources.
- Review Active Directory for signs of credential theft or searches for sensitive keys like LAPS or BitLocker recovery information.
Step-by-step guide: Patch Management Policy: How to Automate Fixes Without Breaking Systems
General security guidance from the Payload Report newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Which Ivanti products are affected by CVE-2026-104935?
Ivanti Connect Secure versions 25.1.1.1 and prior, 25.2.2 and prior, and 22.8R2.4 and prior are affected.
Is there a patch available for the privilege escalation flaw?
No fix has been confirmed yet for the third privilege escalation vulnerability in the attack chain.
What did the attackers do after gaining access?
They stole domain credentials, exfiltrated Active Directory metadata, and searched for LAPS passwords and BitLocker keys.
