CVE-2026-104935: Ivanti VPN Zero-Day Exploited for Root Access

An enterprise VPN gateway is supposed to be one of the strongest security boundaries in an organization’s infrastructure. It authenticates remote users, protects access to internal systems, and often holds credentials that connect directly to corporate identity infrastructure. When that gateway can be compromised without authentication, the consequences extend far beyond the device itself.

That is precisely the concern surrounding CVE-2026-104935, a high-severity vulnerability affecting Ivanti Connect Secure (ICS) VPN appliances. Disclosed on October 13, 2026, the flaw allows remote, unauthenticated attackers to execute arbitrary commands on vulnerable systems. More importantly, security researchers have confirmed that attackers were exploiting it before the vulnerability was publicly disclosed.

The vulnerability carries a CVSS v3.1 score of 8.6, but its practical risk cannot be understood through the score alone. According to Volexity’s technical investigation, an unidentified threat actor tracked as UTA0576 combined the authentication bypass and remote code execution vulnerabilities with a separate privilege escalation flaw to obtain root-level control over an Ivanti VPN appliance.

The attackers subsequently targeted Active Directory credentials, searched for sensitive authentication information, performed internal reconnaissance, and manipulated system logs to conceal evidence of their activity.

The incident illustrates a broader problem with internet-facing security appliances: successful exploitation can compromise not only the appliance but also the credentials and trust relationships connecting it to an organization’s internal network.

For defenders, CVE-2026-104935 should be treated as an active incident-response priority rather than an ordinary patch-management task.

What Is CVE-2026-104935?

CVE-2026-104935 is an authentication bypass and remote command execution vulnerability affecting Ivanti Connect Secure, an enterprise remote-access VPN solution previously associated with the Pulse Secure product family.

The vulnerability is classified under CWE-290, Authentication Bypass by Spoofing. It arises from weaknesses in the way the appliance handles requests between externally accessible web interfaces and internal CGI components.

Under normal circumstances, an unauthenticated user should only be able to access public application functionality, such as the VPN login page. Administrative or otherwise protected backend functionality must remain inaccessible until the appropriate authorization checks succeed.

CVE-2026-104935 breaks this security boundary. A crafted request can cause the system to process operations through an internal component that would ordinarily require a more trusted context.

إن official CVE record confirms that the weakness can allow remote attackers to execute arbitrary commands without authentication.

السمة	Confirmed details
CVE identifier	CVE-2026-104935
Affected vendor	Ivanti
المنتج	Ivanti Connect Secure
فئة الضعف	Authentication bypass and remote command execution
CWE	CWE-290
CVSS v3.1	8.6 — High
ناقل الهجوم	Network
Authentication required	لا يوجد
User interaction	لا يوجد
Exploited in the wild	نعم
CISA KEV status	Added October 13, 2026
Initial public disclosure	October 13, 2026
Vendor fixes	Available for affected release branches

The attack does not require a legitimate VPN account, stolen credentials, or user interaction. An attacker with network access to the vulnerable interface may be able to reach the affected functionality directly.

This distinction is significant because multi-factor authentication does not necessarily protect against a vulnerability that bypasses the application authentication mechanism altogether.

An organization could enforce strong passwords, hardware security keys, and conditional access policies while still exposing a vulnerable appliance to unauthenticated exploitation.

Why CVE-2026-104935 Is More Dangerous Than Its CVSS Score Suggests

A vulnerability rated 8.6 is already serious, but the most important characteristic of CVE-2026-104935 is that exploitation has been confirmed.

إن National Vulnerability Database identifies the flaw as remotely exploitable, requiring low attack complexity and no privileges or user interaction. Its CVSS vector is:

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L

On October 13, 2026, CISA added the vulnerability to its Known Exploited Vulnerabilities catalog, establishing that the issue was no longer merely theoretical.

The catalog specifies October 16, 2026, as the remediation deadline for affected federal civilian agencies under the applicable federal guidance. This deadline is not a universal legal requirement for every organization, but it clearly communicates the urgency assigned to the vulnerability.

Three characteristics make this incident particularly important.

First, Ivanti Connect Secure appliances frequently operate at the edge of enterprise networks. They are intentionally reachable by remote users, which can make vulnerable interfaces accessible from the internet.

Second, these appliances maintain trusted relationships with internal authentication infrastructure. Configuration files and authentication integrations may contain service-account credentials, directory connection settings, certificates, and other sensitive information.

Third, the observed intrusion involved multiple vulnerabilities working together. The attacker did not stop after bypassing authentication. The chain ultimately provided root-level execution through an additional privilege escalation weakness.

A compromise of this kind can transform a perimeter security device into a platform for further internal attacks.

How the CVE-2026-104935 Exploit Chain Works

The technical investigation published by Volexity provides an unusually detailed account of the vulnerabilities and their exploitation.

Researchers reconstructed an attack chain containing three distinct security weaknesses. The authentication bypass and remote code execution components are tracked together under CVE-2026-104935. A separate privilege escalation vulnerability supplied the final step to root-level execution.

Understanding these as separate technical stages is essential. CVE-2026-104935 does not, by itself, represent every weakness in the complete three-stage chain.

Stage 1: Authentication Bypass Through CGI Request Routing

The initial weakness involves the relationship between a publicly accessible web endpoint and the appliance’s internal CGI request-routing mechanism.

Ivanti Connect Secure exposes a public login-related CGI endpoint through its web interface. Requests to this endpoint are allowed before the user has authenticated because the login functionality must be available to new sessions.

However, Volexity discovered that the appliance could rely on different request attributes when evaluating access permissions and determining which backend CGI component should process the request.

The security problem is a mismatch between the component that is authorized and the component that ultimately receives the request.

In the attack observed by Volexity, the adversary exploited this discrepancy to reach an internal CGI handler that should not have been accessible through the unauthenticated request path.

The underlying weakness is not simply a missing login check. It is a failure to consistently enforce the same security identity and authorization context throughout the request-processing pipeline.

That makes the vulnerability a useful example of how complex web gateways can expose unintended attack surfaces when frontend routing decisions and backend execution paths are insufficiently bound together.

From a defensive engineering perspective, authorization must apply to the actual operation and resource being accessed, rather than relying exclusively on a user-controlled representation of the request.

Stage 2: Remote Code Execution Through a Temporary File Race

After bypassing the authentication boundary, the attacker used a separate weakness involving the wu.cgi upload handler.

According to Volexity, the vulnerable component temporarily writes uploaded content to the appliance’s filesystem before completing validation of the submitted file.

The distinction between writing a file and validating it is critical.

A secure file-processing workflow should prevent untrusted content from becoming executable merely because it has been temporarily stored. In the observed case, the application created a short interval during which attacker-controlled content existed in a location that could be reached through the earlier routing weakness.

The attack combined this transient file exposure with a race condition.

The adversary attempted to access the temporary content before the application’s cleanup logic removed it. When the timing conditions were satisfied, the untrusted content could execute within the CGI service context.

This demonstrates why file validation performed after filesystem writes can introduce dangerous secondary effects, particularly when temporary directories and internal routing mechanisms are exposed to other application components.

The attacker then used a sequence of scripts to conduct further operations. Volexity reported that portions of the later-stage Python payload were decompressed and executed in memory rather than remaining as ordinary script files on disk.

The resulting execution context was the CGI service account, not root.

A third vulnerability was necessary to obtain the higher level of privilege observed in the incident.

Stage 3: Privilege Escalation to Root

The final stage targeted the trust relationship between the appliance’s CGI service context and a privileged background service.

Volexity identified a weakness involving the dsinvoked service, which can execute certain maintenance operations with root privileges.

The service relies on configuration information stored in DSCache to determine which programs should be launched for particular maintenance tasks.

The attacker manipulated the trusted configuration state available to the relevant process so that a privileged maintenance operation would invoke attacker-controlled code rather than its intended program.

This was possible through changes to process memory and configuration state rather than a permanent modification of the original library on disk.

Once the manipulated maintenance task executed, the attacker gained root-level privileges.

The exploit subsequently attempted to restore altered state and remove evidence associated with the operation.

Importantly, Volexity reported on October 13 that Ivanti had patched the authentication bypass and remote code execution vulnerabilities tracked under CVE-2026-104935, while a fix for the separately identified privilege escalation vulnerability was still being developed.

That distinction changes how remediation should be interpreted.

Updating to a fixed version closes the known CVE-2026-104935 entry point. It does not establish that every underlying weakness used in the historical exploit chain has been resolved, nor does it establish that an appliance exploited before patching is trustworthy.

The detailed exploit analysis is available in Volexity’s original research.

Real-World Exploitation: UTA0576 Compromises a Fully Updated VPN Appliance

The most important evidence concerning CVE-2026-104935 comes from an actual incident investigated by Volexity.

On October 5, 2026, researchers began examining suspicious activity associated with an Ivanti Connect Secure appliance used by a network security monitoring customer.

The affected device was running version 22.8R2.4, build 19097, which was fully updated at the time of the incident.

Subsequent forensic analysis established that a previously unknown threat actor, designated UTA0576, had begun exploiting the appliance on October 3.

The adversary used the three-stage vulnerability chain to obtain execution capabilities without authenticating to the VPN interface.

This was not an isolated proof-of-concept demonstration. Investigators recovered evidence of substantial post-exploitation activity involving internal directory services and sensitive authentication information.

Volexity reported that the attacker extracted credentials stored on the VPN appliance, investigated Active Directory, and used custom tools to search for high-value directory attributes.

The attacker specifically targeted information associated with Windows Local Administrator Password Solution (LAPS), BitLocker recovery keys, and password-bearing Active Directory attributes.

These targets are particularly sensitive because they can provide additional access to systems that were never directly exposed to the internet.

The attacker also inspected VPN configuration data, performed DNS and host reconnaissance, and carried out password-spraying activity against Active Directory accounts.

In addition, investigators identified attempts to capture and analyze LDAP network traffic passing through the compromised appliance.

The significance of these operations lies in the transition from appliance exploitation to enterprise identity compromise.

An externally reachable VPN device can become a valuable source of privileged service credentials, authentication metadata, and information about internal systems. If the adversary obtains usable secrets, the original vulnerability may no longer be necessary for subsequent access.

Volexity assessed that the observed actions were consistent with preparation for lateral movement and a broader network compromise, although the attackers’ ultimate objectives could not be established because the activity was detected and disrupted.

The actor’s identity remains unknown. Volexity expressed low confidence in its assessment that the activity was criminally motivated rather than espionage-driven.

These distinctions matter: confirmed attacker behavior should not be confused with assumptions about attribution or objectives.

Why the Attack Was Difficult to Detect

One of the most consequential aspects of the CVE-2026-104935 incident was the adversary’s deliberate reduction of forensic evidence.

Traditional incident-response processes often begin by inspecting endpoint files, looking for suspicious executables, and reviewing local application logs.

Those approaches remain valuable, but they can produce incomplete results when an attacker modifies process memory and selectively removes evidence.

Volexity observed that UTA0576 did not deploy a conventional persistent web shell or backdoor on the compromised appliance.

Instead, the actor repeatedly used the exploit chain to execute commands and retrieve results through the attack’s HTTPS communication path.

Some execution stages ran primarily in memory, while other temporary files were removed after use.

Researchers also identified efforts to alter the appliance’s debug logs and Linux audit logs, including activity involving:

/home/runtime/dlogs/debuglog

/var/log/audit/audit.log

The attacker attempted to remove recent evidence of exploitation while preserving unrelated historical log entries.

This behavior is more difficult to identify than simply deleting an entire log file because the resulting logs may still appear structurally normal.

The exploit also restored modified in-memory configuration and library state after privileged execution.

As a result, the changes did not necessarily leave persistent modifications detectable through standard filesystem integrity checks.

Why the Ivanti Integrity Checker Tool May Miss This Attack

Ivanti provides an Integrity Checker Tool (ICT) designed to help identify unexpected modifications to appliance files.

However, the attack investigated by Volexity largely avoided persistent changes to the protected filesystem.

Because key modifications occurred in memory and were subsequently restored, the attacker could evade the type of disk-based integrity checks on which administrators commonly rely.

Volexity specifically warned that the Integrity Checker Tool might not detect compromise associated with this intrusion.

This does not mean ICT has no defensive value. It means a clean integrity check is not sufficient evidence that the appliance has never been compromised.

A credible investigation should correlate network telemetry, authentication activity, memory artifacts, relevant filesystem evidence, and activity across connected enterprise systems.

For an already compromised VPN gateway, the absence of obvious malware is not proof of the absence of an attacker.

CVE-2026-104935 Indicators of Compromise and Detection Opportunities

Security teams investigating possible exposure to CVE-2026-104935 should distinguish between direct evidence of the exploit chain, indicators associated with the observed campaign, and general signs of suspicious activity.

Volexity published actionable hunting guidance and campaign-specific indicators, including request-routing anomalies, temporary script artifacts, and evidence of unauthorized network inspection.

Detection surface	Investigative signal	Interpretation
HTTP request telemetry	Unusual activity involving /dana-na/auth/url_default/welcome.cgi	Potential exploit entry point
HTTP headers	Suspicious X-DSCGI-PATH routing values	Possible authentication bypass activity
Request patterns	Public-facing URL and internal CGI destination mismatch	High-value routing anomaly
Temporary directories	Unexpected scripts or execution artifacts under /tmp/	Potential post-exploitation evidence
Appliance processes	Unexpected packet capture processes or tools	Possible credential collection
Authentication systems	LDAP service-account anomalies and password spraying	Possible movement beyond the VPN
Log integrity	Missing events, unexplained gaps, or suspicious log rewrites	Possible anti-forensic activity
Memory analysis	Unexpected process modifications or suspicious executable regions	Potential memory-resident exploitation

The presence of a single suspicious event does not automatically establish successful exploitation. Conversely, the absence of these indicators does not rule it out, particularly when logs have been altered or relevant telemetry was never collected.

Detecting Suspicious CGI Request Routing

One useful detection strategy is to inspect externally collected HTTP telemetry for requests involving the public VPN login endpoint alongside unusual internal CGI routing information.

Volexity specifically recommends monitoring mismatches between the requested URL and the X-DSCGI-PATH الرأس.

Security teams can begin with a simple Splunk hunt against logs that retain complete HTTP headers.

(index=reverse_proxy OR index=vpn)
("/dana-na/auth/url_default/welcome.cgi"
 OR "X-DSCGI-PATH")
| eval public_login=if(
    match(_raw, "(?i)/dana-na/auth/url_default/welcome\.cgi"),
    1, 0)
| eval internal_route=if(
    match(_raw, "(?i)X-DSCGI-PATH"),
    1, 0)
| where public_login=1 AND internal_route=1
| table _time host source _raw

This is an illustrative hunting query, not a universally validated detection rule. Index names, log fields, and available request-header data must be adapted to the organization’s telemetry.

It will not identify activity if the logging source does not capture the relevant headers. It also focuses on a specific pattern described in the public research rather than every possible variation of the vulnerability.

For higher-confidence detection, analysts should examine the actual values of the routing headers and determine whether the requested public resource was inconsistent with the internal handler selected by the application.

Historical requests that occurred before the security update should receive particular attention.

Threat-Hunting Beyond the VPN Device

Volexity’s investigation demonstrated that compromising the VPN appliance was only the beginning of the observed intrusion.

Security teams should examine whether the device’s authentication-related service accounts accessed directory information outside their normal operational patterns.

Suspicious activity might include unusually broad LDAP searches, requests for sensitive directory attributes, authentication attempts originating from unexpected sources, or access to LAPS and BitLocker recovery information.

Network monitoring can also identify abnormal connections initiated by a VPN gateway toward internal systems.

The baseline matters. Some directory queries and authentication operations are legitimate functions of an enterprise VPN deployment.

The objective is to identify deviations that indicate the appliance’s established trust relationships may have been abused.

Volexity also identified the address 108.165.147[.]64 in association with the observed operation. Such infrastructure indicators should be treated as investigation pivots rather than universal signatures, since attackers can change infrastructure and shared hosting addresses may have legitimate users.

The original Volexity threat intelligence report includes a link to its published indicator repository and additional forensic details.

Which Ivanti Connect Secure Versions Are Affected?

The appropriate remediation depends on the appliance’s software release branch.

According to the Rapid7 vulnerability advisory, Ivanti identified affected and resolved versions across several supported branches.

Release branch	الإصدارات المتأثرة	Resolved version
25.1.1.x	25.1.1.1 and earlier within the applicable branch	25.1.1.2
25.1.2.x	25.1.2.2 and earlier within the applicable branch	25.1.3.0 or 25.1.3.1
22.8R2.x	22.8R2.4 and earlier within the applicable branch	22.8R2.5
22.7.x and earlier	Not affected according to Ivanti	Not applicable for this CVE

The official CVE record identifies 25.1.3.0, 25.1.3.1, 22.8R2.5, and 22.7R2.14 as unaffected versions. Other advisories describe 25.1.3.1 as the resolved build for certain 25.1.3.x installations. Administrators should follow Ivanti’s platform-specific release guidance rather than comparing version numbers across unrelated release branches.

For authoritative update information, refer to the Ivanti security advisory for CVE-2026-104935.

It is also important to verify the exact deployed build instead of relying exclusively on historical inventory records.

Appliances that were fully updated before October 2026 may still be vulnerable if they did not receive the subsequent security update. The device investigated by Volexity was running the latest available build at the time of compromise.

Organizations should therefore confirm installed versions directly through trusted administrative interfaces and correlate those findings with their asset inventory and change-management records.

How to Patch CVE-2026-104935 Safely

The immediate defensive priority is to prevent further exploitation while preserving any evidence needed to determine whether a breach has already occurred.

For organizations with exposed vulnerable appliances, an emergency update should take precedence over the normal patch cycle.

However, remediation is not simply a matter of installing the newest software and considering the incident closed.

Contain Exposure and Preserve Evidence

If exploitation is suspected, the first priority is containment.

Disconnecting or restricting the affected appliance can help prevent additional external access and reduce opportunities for lateral movement into internal networks.

Where practical, incident responders should preserve volatile evidence before shutting down or rebuilding a potentially compromised device.

This may include memory acquisition, filesystem snapshots, network-flow records, authentication logs, and relevant events collected by external monitoring systems.

On October 14, France’s CERT-FR published an incident alert for Ivanti Connect Secure recommending isolation, evidence preservation, forensic investigation, and credential remediation when compromise is identified.

The order of operations matters. Destroying volatile evidence before an investigation can make it substantially more difficult to establish how an attacker entered the environment or what they accessed.

Apply the Appropriate Vendor Update

After the required evidence has been preserved, administrators should apply the fixed software build corresponding to the appliance’s supported release branch.

Updates should come through official Ivanti distribution channels.

Organizations should follow the vendor’s published upgrade path, verify appliance compatibility, and account for high-availability configurations or operational dependencies.

After installation, the updated version should be independently confirmed.

A successful update is evidence that the known vulnerable code path has been addressed. It is not evidence that attackers did not exploit the system before remediation.

Rotate Credentials That May Have Been Exposed

The observed attacks specifically targeted directory credentials and sensitive authentication information.

For potentially compromised appliances, security teams should determine which secrets were stored on the gateway, available through its integrations, or transmitted in accessible form during the intrusion window.

Depending on the environment, remediation may involve resetting LDAP or Active Directory service-account credentials, rotating administrative passwords, revoking exposed tokens or Kerberos tickets, replacing relevant certificates, and invalidating other potentially compromised secrets.

Credential rotation should be coordinated with the appliance recovery process to avoid reintroducing compromised secrets into a rebuilt environment.

Investigate Lateral Movement

The incident should not be scoped exclusively to the Ivanti device.

Analysts should investigate activity originating from the appliance toward domain controllers, identity services, administrative interfaces, and other sensitive internal resources.

Any unusual authentication attempts, directory enumeration, password spraying, or suspicious administrative access during the suspected compromise period should be correlated with other available telemetry.

When compromise is confirmed, rebuilding the appliance according to vendor recovery guidance may be necessary. Organizations should not assume that an ordinary software upgrade, by itself, removes all persistence or eliminates all stolen credentials.

Does Patching CVE-2026-104935 Completely Remove the Risk?

For the vulnerability addressed by CVE-2026-104935, installing the appropriate fixed version is the primary remediation.

However, two residual risk categories require separate attention.

The first is historical compromise. If attackers successfully exploited the gateway before it was patched, they may have already extracted credentials or used their access to compromise other systems.

Patching the original vulnerability does not reverse credential theft, unauthorized directory access, or lateral movement.

The second concerns the separate privilege escalation vulnerability used in the observed exploit chain.

As of the October 13 disclosure, Volexity reported that this additional weakness had not yet been patched and that Ivanti was developing a fix.

That does not mean the full CVE-2026-104935 exploit chain remains functional against appropriately patched appliances. The authentication bypass and command execution entry points have been addressed in the relevant releases.

It means defenders should continue monitoring the vendor’s security advisories and treat the separate privilege escalation weakness as an outstanding issue until its remediation is independently confirmed.

This is also why organizations should distinguish vulnerability remediation from incident remediation.

The first closes a known weakness. The second establishes whether the organization remains exposed to the consequences of past exploitation.

How to Validate CVE-2026-104935 Exposure Without Disruptive Exploitation

For security teams, a practical difficulty is determining whether an appliance is vulnerable without introducing additional risk through aggressive testing.

Because CVE-2026-104935 affects production VPN infrastructure, exploit-based testing against live gateways may be operationally dangerous.

The publicly documented exploitation chain involves sensitive application internals, file-processing behavior, race conditions, and potentially privileged execution. Reproducing such behavior on an operational device is not necessary for routine vulnerability inventory or patch verification.

A safer validation process begins with authenticated version discovery and asset identification.

Teams should confirm the installed software build, map it to the correct release branch, review current vendor guidance, and determine whether the relevant service is externally accessible.

That evidence can establish exposure to a known affected release without executing the vulnerability.

The next stage is defensive verification: examine historical telemetry for suspicious request-routing behavior, review authentication-related activity, and assess the integrity of relevant monitoring records.

Where there is evidence of exploitation, validation becomes an incident-response and forensic task rather than a conventional penetration test.

For organizations that need controlled adversarial testing, any attempt to reproduce the exploit should take place in an isolated, representative environment with explicit authorization and safeguards.

This separation is particularly important for internet-facing infrastructure whose availability is essential to normal business operations.

From Vulnerability Detection to Verified Security Exposure

The Ivanti incident highlights a limitation of vulnerability management built entirely around scanner findings.

A scanner can identify an affected version, but that result does not automatically explain which systems are reachable, which internal trust relationships could be exposed, or whether earlier attacker activity may have occurred.

Effective exposure management combines several forms of evidence.

Asset discovery establishes where the affected technology is deployed. Version verification establishes whether the published fix is present. Network analysis establishes how the asset can be reached. Security telemetry provides potential evidence of attempted or successful exploitation.

Those findings should ultimately be assembled into a reproducible report that security engineers can review and act upon.

For teams evaluating automated penetration testing and security validation workflows, the important distinction is between generating vulnerability alerts and producing reliable evidence of actual exposure.

Authorized testing can help validate network reachability, identify unsafe configurations, assess segmentation boundaries, and verify that changes to the environment have reduced exposure.

However, such testing should not be presented as a substitute for forensic analysis of a potentially compromised gateway.

A high-quality security assessment should make that boundary explicit, demonstrating what has been verified, what remains uncertain, and what requires specialist investigation.

Organizations seeking a structured, evidence-led validation workflow can explore IthacaSec as a starting point for discussing their security assessment requirements.

What CVE-2026-104935 Reveals About Enterprise VPN Security

This incident is part of a broader pattern in which attackers target network infrastructure that sits between the public internet and trusted corporate environments.

VPN gateways, application delivery controllers, firewalls, and other edge devices present attractive targets because they combine external accessibility with significant internal privileges.

Unlike a typical user workstation, a security appliance may have direct network access to authentication servers, administrative services, sensitive application networks, and centralized configuration systems.

Its compromise can therefore undermine several controls that organizations assume are protecting their internal infrastructure.

CVE-2026-104935 also demonstrates why security teams need to examine trust boundaries inside security products themselves.

The initial exploit depended on inconsistency between request authorization and internal request routing. The subsequent command execution relied on unsafe handling of temporary uploaded content. The final privilege escalation abused trust in configuration state consumed by a root-privileged service.

Although these vulnerabilities affected different components, their combination created a much more serious result than any single implementation defect considered in isolation.

This is a familiar pattern in sophisticated exploitation: relatively narrow weaknesses become powerful when they can be chained across authorization, execution, and privilege boundaries.

The same incident reinforces another lesson: security products require the same depth of monitoring and incident-response preparation as the systems they are intended to protect.

Organizations should not assume that a dedicated appliance is inherently resistant to memory-resident activity, credential theft, or log manipulation.

Independent telemetry, centralized logging, memory forensics capabilities, segmentation, and disciplined credential management can all reduce the consequences of an appliance compromise.

Frequently Asked Questions About CVE-2026-104935

Is CVE-2026-104935 being actively exploited?

Yes. Ivanti acknowledged exploitation in the wild when the vulnerability was publicly disclosed on October 13, 2026. CISA added it to the Known Exploited Vulnerabilities catalog on the same day, and Volexity documented exploitation beginning on October 3.

Is CVE-2026-104935 a remote code execution vulnerability?

Yes. Although the official weakness classification focuses on authentication bypass by spoofing, the published vulnerability also allows unauthenticated remote command execution. Volexity identified the authentication bypass and RCE components as two related weaknesses tracked under the same CVE.

Can attackers gain root access through CVE-2026-104935?

Researchers observed root-level command execution when CVE-2026-104935 was combined with a separate privilege escalation vulnerability. The full exploit chain included three weaknesses. Root-level execution should therefore not be attributed solely to CVE-2026-104935.

Does multi-factor authentication prevent exploitation?

No. MFA is not an adequate mitigation for an unauthenticated exploit that bypasses the affected application’s authentication boundary. Administrators must apply the relevant security update and follow the vendor’s remediation guidance.

Are Ivanti Connect Secure 22.7 versions affected?

According to the vendor’s published records, versions 22.7.x and earlier are not affected by this particular vulnerability. Administrators should still evaluate those installations for other security issues and verify their support status.

Is a clean Ivanti Integrity Checker result enough?

No. Volexity documented an exploit chain involving memory-only changes, restoration of altered state, and deliberate log manipulation. A clean ICT result does not conclusively rule out previous compromise.

Is there a patch for CVE-2026-104935?

Yes. Ivanti has published fixes for the affected release branches, including 25.1.1.2, 25.1.3.0 or 25.1.3.1, and 22.8R2.5, depending on the installed software branch.

What should organizations do if they cannot patch immediately?

Organizations should review Ivanti’s current guidance, reduce exposure, and isolate affected systems where necessary. If compromise is suspected, preserve evidence and begin incident-response procedures. Simply restricting an interface should not be assumed to eliminate the underlying vulnerability.

Final Assessment: Treat CVE-2026-104935 as an Active Threat, Not Just a Patch

CVE-2026-104935 demonstrates how a vulnerability in an enterprise remote-access gateway can rapidly become an organization-wide security problem.

The confirmed attack involved far more than bypassing a VPN login page. It combined vulnerabilities across multiple trust boundaries, obtained privileged execution, targeted sensitive directory credentials, and attempted to conceal forensic evidence.

The involvement of an internet-facing security appliance makes the consequences especially serious.

For organizations operating affected Ivanti Connect Secure releases, the immediate priorities are clear: establish exposure, apply the appropriate security updates, investigate possible historical exploitation, and protect any credentials that may have been accessible to the compromised appliance.

The incident also reinforces an important distinction for modern cybersecurity operations.

Identifying a vulnerable asset is only the beginning. Understanding whether that weakness has been exploited, what privileges an attacker could obtain, and whether connected systems remain at risk is what turns vulnerability management into effective security validation.

As attackers increasingly combine application flaws, privileged services, and memory-resident techniques, organizations need security testing and incident-response processes that account for the entire attack path—not just the individual CVE.

For CVE-2026-104935, the patch closes a critical entry point. Establishing confidence in the security of the surrounding environment requires evidence that extends beyond the patch itself.