Overview
- Ivanti publicly disclosed the authentication‑bypass and RCE issue tracked as CVE‑2026‑104935 and released updates that fix those two components on Tuesday, Oct. 13, while a separate privilege‑escalation flaw used in the same chain is not yet patched.
- Security firm Volexity says an actor it tracks as UTA0576 has chained three zero‑days since early October to gain unauthenticated root on Connect Secure appliances and repeatedly re‑ran the chain for each command rather than leaving a persistent web shell.
- Investigators found the intruder stole stored credentials, harvested Active Directory data, sought LAPS and BitLocker recovery keys, and tampered with logs, so organizations should hunt for signs of compromise with network and memory forensics rather than relying only on Ivanti’s Integrity Checker.
- Affected Connect Secure builds include versions up through 25.1.1.1/25.1.2.2 and 22.8R2.4 and Ivanti lists fixed builds such as 25.1.3.0, 25.1.3.1 and 22.8R2.5; customers are urged to upgrade immediately if they run an impacted release.
- CISA added CVE‑2026‑104935 to its Known Exploited Vulnerabilities catalog and set an Oct. 16 federal deadline, and with more than 5,500 internet‑reachable Ivanti appliances reported, analysts warn rapid, wider exploitation and deeper network intrusions are likely without fast remediation and forensic response.