CVE-2026-104935

Three Zero-Days Chained in Ivanti Connect Secure Grant Root Access Without Login

An attacker chained three zero-day vulnerabilities in Ivanti Connect Secure to execute commands as root without authentication. The compromised appliance was running the fully patched version 22.8R2.4 when exploitation began on October 3. Volexity discovered the intrusion, attributed the activity to UTA0576 with low confidence in criminal rather than espionage motives, and reported the flaws to the vendor. Ivanti acknowledged limited in-the-wild exploitation on October 13. The first two issues, an authentication bypass and remote code execution, were combined under CVE-2026-104935 with a CVSS score of 8.6, allowing code execution as the cgi-server user. A third privilege-escalation flaw then elevated access to root. The final flaw lacked a patch at disclosure time, with a fix promised in an upcoming release. CISA classified the exploitation as active with total technical impact.

Ivanti Connect Secure VPN Hit by Zero-Day Authentication Bypass Vulnerability CVE-2026-104935

Ivanti has disclosed a critical authentication bypass vulnerability in its Ivanti Connect Secure remote access product that allows remote attackers to execute arbitrary commands without authentication. The flaw, tracked as CVE-2026-104935, carries a CVSSv3.0 base score of 8.6 and has already been exploited in the wild against certain customer environments. Affected versions include 25.1.2.2, 25.1.1.1, and 22.8R2.4 along with earlier releases in those branches, while versions 22.7R2.14 and prior remain unaffected. Ivanti discovered the issue through its product security program and released the fix in version 25.1.3.0 during July. The company published its security advisory on October 13, 2026, confirming active exploitation of the zero-day in unpatched branches.