Ivanti Connect Secure vulnerability CVE-2026-104935: timeline of a VPN zero-day
On October 13, 2026, Ivanti published a security advisory for the Ivanti Connect Secure vulnerability CVE-2026-104935 (CVSS 8.6), and CISA added it the same day to its catalog of actively exploited vulnerabilities. The uncomfortable detail: the flaw had been exploited as a zero-day since early October, including on VPN gateways that were fully up to date. Here’s the timeline, step by step, and the list of what an SMB should do today.
Ivanti Connect Secure is a widely used enterprise VPN. Like any remote-access gateway, it sits at the front door of your network — the same strategic spot we described for GlobalProtect. Rapid7 also notes this product was already hit by zero-days in 2024 and 2025.
Timeline of the Ivanti Connect Secure zero-day
🕒 From discovery to emergency patch
July 2026
Part of the problem is already fixed… in a single branch
According to Ivanti (as cited by Rapid7), part of the flaw was first found by its own product security program and fixed in version 25.1.3.0, released in July. Work to backport that fix to the other supported versions was still under way.
Early October 2026 (around Oct. 1)
The zero-day is exploited on up-to-date appliances
Digital forensics firm Volexity detects threat actor UTA0576 exploiting the flaw on Ivanti Connect Secure appliances fully patched on 22.8R2.4. Being “patched” offered no protection.
Chain step 1
Authentication bypass by spoofing
CVE-2026-104935 is an authentication bypass by spoofing (CWE-290). A remote attacker with no account passes as legitimate to the VPN gateway.
Chain step 2
Unauthenticated command execution
Once authentication is bypassed, the attacker can run arbitrary commands on the Connect Secure appliance. Volexity tracks this part of the chain under the same identifier, CVE-2026-104935.
Chain step 3
Privilege escalation: a fix still pending
Volexity reports the attacker also used a separate privilege-escalation flaw that was not yet patched when the advisory came out. Ivanti plans to fix it later.
Before disclosure
A limited number of customers affected
Ivanti says, according to Rapid7, that a limited number of customers were affected before the advisory was published. That’s the very definition of a zero-day: exploitation comes before the fix.
October 13, 2026
Ivanti advisory, emergency patch and KEV listing
Ivanti publishes its advisory (CVSS 8.6) and fixed versions. The same day, CISA adds CVE-2026-104935 to its Known Exploited Vulnerabilities (KEV) catalog. Rapid7 recommends applying the update on an emergency basis, outside normal patch cycles.
Now
Patch, then hunt for traces
Install the fixed version for your branch, then check whether the appliance was compromised before the update. The Integrity Checker Tool can miss this chain because it runs in memory.
Affected and fixed versions
| Branch | Affected versions | Version to install |
|---|---|---|
| 25.1.1.x | 25.1.1.1 and prior | 25.1.1.2 |
| 25.1.2.x | 25.1.2.2 and prior | 25.1.3.0 or 25.1.3.1 |
| 22.8R2.x | 22.8R2.4 and prior | 22.8R2.5 |
| 22.7.x and below | Not affected per Ivanti’s advisory | Still confirm your version is supported |
Urgency checklist: what to do, in what order
✅ Urgency checklist — Ivanti Connect Secure vulnerability CVE-2026-104935
- ☐ Today: list every Ivanti Connect Secure appliance (head office, branches, IT provider) and record its exact version.
- ☐ Today: install the fixed version for your branch (25.1.1.2, 25.1.3.0 / 25.1.3.1 or 22.8R2.5).
- ☐ Today: if the appliance ran an affected version and was internet-facing since early October, treat it as possibly compromised.
- ☐ Don’t rely on the Integrity Checker Tool alone: the chain runs in memory. Keep logs and bring in forensics if in doubt.
- ☐ If you suspect compromise: follow Ivanti’s recovery steps, then rotate passwords and secrets that pass through the VPN.
- ☐ This week: review VPN logins and unusual accounts since October 1.
- ☐ In the coming weeks: watch for the upcoming privilege-escalation fix and install it as soon as it ships.
🏢 What this means for an SMB
Many SMBs don’t know which VPN brand they use: often the IT provider or head office installed it. Ask in writing: “Do we use Ivanti Connect Secure, which version, and has it been updated since October 13?”
And take the lesson from this timeline: an “up-to-date” appliance can still be compromised before a patch ships. That’s why you check for traces, not just the version number.
A compromised VPN gateway often opens the door to the rest of the network. After patching, automated 24/7 monitoring with on-call technician response helps spot unusual logins or behaviour before they turn into a major incident. Learn about our cyber monitoring and our cybersecurity services.
Book your free cyber check
Not sure which VPN protects your remote access, or whether it’s up to date? Our free cyber check finds your exposed gateways and their versions, and gives you a clear, jargon-free plan.
Call us at 438-476-2322 or email info@neotechcloudsolutions.com.
Sources
- CISA — CISA Adds Two Known Exploited Vulnerabilities to Catalog (October 13, 2026)
- Rapid7 — Ivanti Connect Secure zero-day exploited in the wild (CVE-2026-104935)
- Ivanti — Security Advisory Ivanti Connect Secure (CVE-2026-104935)
- CVE.org — CVE-2026-104935
Photo: ThisIsEngineering, Pexels (Pexels licence).