Ivanti Connect Secure Zero-Day CVE-2026-104935 Added to CISA Known Exploited Vulnerabilities Catalog
CISA has mandated rapid patching for Ivanti Connect Secure appliances after threat actors exploited an authentication bypass zero-day to gain root access and steal credentials.
On October 13, 2026, Ivanti released an advisory acknowledging that attackers had exploited a previously unknown vulnerability across its Connect Secure appliances prior to disclosure. The vendor confirmed a high-severity authentication bypass by spoofing vulnerability with a CVSSv3.0 score of 8.6 that allows remote unauthenticated attackers to execute arbitrary commands, designated CVE-2026-104935. Digital forensics firm Volexity had already observed threat actor activity leveraging the flaw in early October 2026, confirming that real-world intrusions preceded the availability of a vendor fix.
The Cybersecurity and Infrastructure Security Agency acted immediately upon Ivanti’s disclosure, adding CVE-2026-104935 to its Known Exploited Vulnerabilities catalog the same day. The listing triggers binding timelines across federal networks, reflecting the significant risk posed when edge gateways that manage corporate ingress can be commanded remotely without valid credentials.
The reach of the flaw spans multiple product releases. In response to active exploitation, CISA urged organizations to update Ivanti Connect Secure appliances, noting that affected versions include 25.1.1.1 and prior, 25.1.2.2 and prior, and 22.8R2.4 and prior. Federal Civilian Executive Branch agencies were ordered to apply fixes under a tight turnaround deadline of October 16, 2026.
The operational impact of the vulnerability stems from how attackers chain it with follow-on exploits. Forensic analyses revealed that threat actors such as UTA0576 pair the initial authentication bypass with local privilege escalation to secure root control over target devices. Once established with administrative authority on an appliance, attackers moved to harvest internal credentials, successfully obtaining LDAP domain credentials to facilitate further movement across enterprise networks.
Because Ivanti Connect Secure gateways occupy a trusted position at the perimeter of enterprise networks, compromise at this layer undermines subsequent internal access controls. When an unauthenticated attacker can execute arbitrary commands at the boundary, the visibility of internal security logging is often bypassed entirely until domain accounts show anomalous activity elsewhere.
The three-day remediation window set for federal agencies reflects the narrowing defensive margin typical of perimeter zero-days. Because malicious activity was confirmed weeks before patches became available, defensive work extends beyond simply updating device software to conducting forensic analysis for signs of post-exploitation credential harvesting.