Ivanti Connect Secure is under active zero-day attack. CVE-2026-104935 is an authentication bypass, scored 8.6, that lets a remote attacker with no account run arbitrary commands. CISA added it to the Known Exploited Vulnerabilities catalog on 13 October and set a federal deadline of 16 October 2026.
What happened
Ivanti shipped fixes on 13 October in versions 22.8R2.5, 25.1.3.0, 25.1.3.1, and 25.1.1.2, and told customers to act immediately because of limited exploitation in the wild. Volexity tracks the actor as UTA0576 and says the bug was chained with a remote code execution flaw and a privilege escalation flaw for unauthenticated root. Those attacks were seen from at least 3 October. Defused reported earlier signs on 1 October.
Post-exploitation included theft of Active Directory secrets, Local Administrator Password Solution passwords, and BitLocker recovery keys. CISA says the goal observed so far is credential theft and data exfiltration. Shadowserver is tracking more than 5,600 internet-exposed hosts with Connect Secure fingerprints. That count includes honeypots and already-patched systems, so it is exposure, not a victim total.
Who is affected
Connect Secure versions 25.1.1.1 and earlier, 25.1.2.2 and earlier, and 22.8R2.4 and earlier are in scope. Any internet-facing VPN concentrator used for remote access, including MSP jump hosts and customer edge devices, is the practical target. This is the sixth Ivanti flaw added to CISA's exploited list in 2026.
What to do now
Patch every Connect Secure appliance today, then treat a late patch as a possible compromise. CISA warns that Ivanti's Integrity Checker Tool may miss this activity because attacker commands run in memory. If you cannot prove the device was clean before the fix, back up the configuration, factory-reset or rebuild the virtual instance, upgrade, restore the config, and reset every local, admin, and domain password. Revoke and reissue stored certificates, API keys, and license-server credentials. Then hunt for new admin accounts, unexpected VPN sessions, and dumped LAPS or BitLocker material.
- Confirm the running build is 22.8R2.5, 25.1.3.0, 25.1.3.1, 25.1.1.2, or later.
- Do not trust a clean integrity-checker result as proof the device was never hit.
- Reset credentials that the appliance could reach, not only the appliance admin password.
- Federal-style urgency applies here even if you are not a US agency: the KEV due date is Friday 16 October.
Source: BleepingComputer, citing CISA, Ivanti, and Volexity. CISA warns admins to immediately fix Ivanti flaw exploited as zero-day.
Also on the blog
- CVE-2026-96951: Windows MotW bypass exploited, patch by 16 Oct
- YAM Store phishing market disrupted after 1 billion messages
- curl CVE-2026-92392 HTTP/2 upload flaw fixed in 8.23.0
- n0n lists 38 ports and shipping firms, deadline 19 October
Next step: If this is on your network or a client's, ask Matthews Enterprises to check exposure.