Ivanti Connect Secure Zero-Day Vulnerability (CVE-2026-104935)

The Threat

On October 13th, 2026, Ivanti disclosed a high severity vulnerability impacting its Ivanti Connect Secure product. The vulnerability, tracked as CVE-2026-104935 (CVSS: 8.6), is an authentication bypass by spoofing, which can allow an unauthenticated remote attacker to execute arbitrary commands on impacted devices. Patches have been released to address the vulnerability.

At the time of disclosure, Ivanti has confirmed in the wild exploitation impacting a "limited number" of customers. As exploitation is ongoing, organizations that utilize Ivanti Connect Secure within their environment should prioritize patching as soon as possible.

What we're doing about it

• eSentire MDR for Network has detections in place to identify exploitation of CVE-2026-104935
• eSentire's Managed Vulnerability Service (MVS) will add relevant plugins as they become available
• eSentire customers can employ the Vulnerabilities and Inferred Vulnerabilities pages in Atlas Portal to search for potentially vulnerable assets
• eSentire's Threat Response Unit (TRU) is tracking this topic for additional information and detection opportunities

What you should do about it

• After performing a business impact review, apply the relevant security patches immediately
  • Organizations should consult the Ivanti Connect Secure Upgrade and Migration Compatibility Guide for an overview of migration paths across both hardware and virtual appliances
• If compromise is suspected, organizations should perform forensic investigation and follow the recovery steps outlined by Ivanti within their advisory
• Follow Ivanti's security best practices guide for configuring Ivanti Connect Secure

Additional information

On October 13th, Volexity published a report, detailing in-the-wild exploitation of CVE-2026-104935, which it attributed to UAT0576 and assessed with "low confidence" as having criminal motivations rather than espionage. Volexity states that the vulnerability chains together an authentication bypass and a Remote Code Execution (RCE) flaw. UTA0576 also leveraged a separate privilege escalation vulnerability, which will be addressed in a "future release", chained with CVE-2026-104935 to achieve unauthenticated root-level code execution on the target device. Post-exploitation activity included credential theft, data exfiltration, log tampering, and network reconnaissance.

Following Ivanti's disclosure, CISA added CVE-2026-104935 to its Known Exploited Vulnerabilities (KEV) catalog, giving Federal Civilian Executive Branch (FCEB) agencies a deadline of October 16th to apply relevant patches. Although Ivanti indicates that only a "limited number" of customers were impacted, and that those customers have been contacted, there is a history of Ivanti Connect Secure vulnerabilities being leveraged within attacks. At the time of writing, there is no publicly available Proof-of-Concept (PoC) exploit code for CVE-2026-104935, which would lower the barrier for more widespread attacks, but this could change. As exploitation is ongoing, organizations that deploy Ivanti Connect Secure within their environment should ensure that the latest security patches are applied immediately.

References:

[1] https://hub.ivanti.com/s/article/Security-Advisory-Ivanti-Connect-Secure-CVE-2026-104935?language=en_US
[2] https://nvd.nist.gov/vuln/detail/cve-2026-104935
[3] https://hub.ivanti.com/s/article/Ivanti-Connect-Secure-25-x-Upgrade-and-Migration-Compatibility-Guide?language=en_US
[4] https://hub.ivanti.com/s/article/KB29805?language=en_US
[5] https://www.volexity.com/blog/2026/10/13/a-series-of-unauthenticated-events-chained-exploitation-of-ivanti-connect-secure-zero-days/
[6] https://www.cisa.gov/news-events/alerts/2026/10/13/cisa-adds-two-known-exploited-vulnerabilities-catalog
[7] https://www.esentire.com/security-advisories/ivanti-connect-secure-zero-day-vulnerability