Ivanti Connect Secure zero-day (CVE-2026-104935): what to do now
Incident response · 6-min read · Check your Ivanti version → · updated October 2026
Ivanti Connect Secure is under active attack via CVE-2026-104935 — an authentication bypass (CVSS 8.6) that attackers have chained into unauthenticated, root-level code execution on the appliance. It was exploited as a zero-day before the fix existed, and it's on CISA's KEV list. If you run an internet-facing Ivanti VPN, this is a patch-and-investigate emergency — not just a patch.
Affected & fixed versions
| Your branch | Fixed in |
|---|---|
| 25.1.3.x | 25.1.3.0 / 25.1.3.1 |
| 25.1.2.x and prior | 25.1.2.2 is affected — move to a fixed build |
| 25.1.1.x and prior | 25.1.1.2 |
| 22.8Rx (≤ 22.8R2.4) | 22.8R2.5 |
| 22.7.x and earlier | Not affected (per Ivanti) — but still verify |
Check your Ivanti Connect Secure version → to confirm whether the build you run is affected, or see the product's full vulnerability record.
What to do — in order
Affected: Ivanti Connect Secure 25.1.1.1 and prior, 25.1.2.2 and prior, and 22.8R2.4 and prior. Ivanti states 22.7.x and earlier (incl. 22.7R2.14) are not affected. If you run an affected build and the appliance is internet-facing, treat it as high-priority.
Update to 22.8R2.5, 25.1.1.2, 25.1.3.0 or 25.1.3.1 — the builds that contain the fix. Ivanti released these on 13 Oct 2026. US federal agencies had a CISA KEV deadline of 16 Oct 2026; treat it with the same urgency.
This was exploited as a zero-day before the fix existed: a threat actor (tracked UTA0576) chained CVE-2026-104935 with other flaws for unauthenticated root-level code execution, reportedly since early October. Patching closes the door but does not remove an intruder who already got in, and does not revoke credentials they stole.
Run Ivanti's Integrity Checker Tool (ICT), review appliance and authentication logs for anomalies, and look for web shells, unexpected root processes or outbound connections. If the device was internet-facing and unpatched before 13 Oct, investigate as if it may be breached.
A chained root RCE means full device control. Per Ivanti/CISA guidance for these appliances: factory-reset and rebuild from a clean image, then rotate ALL secrets that passed through it — admin and service credentials, API keys, certificates, and any credentials of users who authenticated through the VPN.
Why this one matters
- Pre-authentication — the bypass needs no valid account; it's reachable by anyone who can hit the appliance.
- Chained to root RCE — combined with other flaws, it yields full control of the device.
- Edge appliance — it sits at your network perimeter, so a compromise is a direct foothold inside.
- Exploited before the patch — a true zero-day, so "we patched on release day" may still be too late.
Turn this into action. An actively-exploited authentication bypass (CVSS 8.6) chained to unauthenticated root code execution on Ivanti Connect Secure — exploited as a zero-day before the fix existed. The affected and fixed versions, and the critical catch: patching alone is NOT enough — you must hunt for compromise.
Check your Ivanti version — free →Frequently asked questions
What is CVE-2026-104935?
A high-severity authentication-bypass vulnerability in Ivanti Connect Secure (CVSS v3.1 8.6), exploited via spoofing/impersonation. On its own it bypasses authentication; attackers have chained it with additional flaws to achieve unauthenticated, root-level remote code execution on the appliance.
Which versions are affected, and which fix it?
Affected: Connect Secure 25.1.1.1 and prior, 25.1.2.2 and prior, and 22.8R2.4 and prior. Fixed builds (released 13 Oct 2026): 22.8R2.5, 25.1.1.2, 25.1.3.0 and 25.1.3.1. Ivanti says 22.7.x and earlier are not affected.
Is it being actively exploited?
Yes. It was exploited in the wild as a zero-day before a patch was available, and it is in CISA's Known Exploited Vulnerabilities catalog (with an October 2026 federal remediation deadline). Reporting attributes the activity to a threat actor tracked as UTA0576, chaining it into root-level RCE.
Is patching enough?
No — this is the critical point. The patch stops new exploitation, but it does NOT evict an attacker who already compromised the device or revoke credentials they stole, and researchers note a related root privilege-escalation path that patching alone may not fully resolve. You must patch AND hunt for compromise.
How do I check whether we were compromised?
Run Ivanti's Integrity Checker Tool (ICT) and review appliance/auth logs against the indicators of compromise published in the vendor and threat-intel advisories. Internet-facing appliances unpatched before mid-October should be treated as suspect until proven clean.
Why are Ivanti VPN appliances such frequent targets?
Internet-facing VPN/remote-access gateways sit at the network edge with no authentication in front of them, so a pre-auth flaw gives attackers a direct foothold into the corporate network. That makes them a recurring, high-value target — keeping them patched and monitored is essential.
This guide is vendor-neutral and informational, grounded in publicly-available guidance from bodies such as OWASP, NIST and CISA. IsItPatched is independent and not affiliated with them, and this is not legal or compliance advice. See our disclaimer.