Ivanti discloses actively exploited Connect Secure authentication-bypass zero-day; CISA lists CVE-2026-104935
Event summary
Ivanti disclosed on October 13 that attackers had exploited CVE-2026-104935 in Connect Secure before public disclosure. The 8.6-severity authentication bypass permits unauthenticated command execution on affected enterprise VPN appliances. CISA added it to its Known Exploited Vulnerabilities catalog and vendor fixes are available.
CHRONOS Wire · October 14 · Alert 5
Publication details
- Published
- Updated
- Revision
- r497762
- Source
- Ivanti
Cliff Notes
- Ivanti and CISA confirm a newly disclosed, already exploited enterprise VPN zero-day. Unauthenticated attackers can execute commands on affected Connect Secure devices; patches exist, but affected organizations should also investigate past compromise.
U.S. Impact
Current impact
Low
U.S. enterprise and government VPN operators running affected Connect Secure releases face confirmed exploitation risk requiring immediate patching and compromise checks.
Potential impact
Elevated
Further exploitation could expose enterprise networks and services if attackers obtain remote access and persist or move laterally.
- Impact type
- Direct
- Time horizon
- Immediate to short term (hours to weeks)
- Confidence
- Very High
- Key channels
- Enterprise remote access · Cyber intrusion · Federal vulnerability remediation · Identity and credential compromise
Direct effects
Elevated
Confirmed exploited vulnerability in enterprise perimeter devices with immediate patch and incident-response consequences.
- Unauthenticated command execution on affected VPN appliances
- Potential persistence on compromised edge devices
Indirect effects
Low
Possible downstream enterprise disruption and supply-chain exposure if initial access leads to lateral movement.
- VPN foothold to internal network
- Vendor/contractor access to partner environments
Supporting evidence
- Ivanti publicly disclosed CVE-2026-104935 on October 13
- CISA added the CVE to its Known Exploited Vulnerabilities catalog
- Rapid7 reports vendor-confirmed exploitation and available fixes
Negative evidence
- Ivanti describes a limited set of affected customers
- No verified global victim count or widespread outage
- Patches are available for affected branches
Uncertainties
- Actual U.S. exposure and number of compromised appliances
- Whether attackers used the additional privilege escalation issue
- Effectiveness of recovery and patch adoption
Assessment reasoning
CISA's KEV designation and Ivanti's exploitation acknowledgment support direct current U.S. cyber risk, although the number of compromised systems is not known. Potential consequences are larger than observed confirmed losses; scores distinguish active exposure from hypothetical widespread disruption.
U.S. Impact is an analytical assessment of the estimated current and potential effects on the United States. It is not a probability forecast.
On October 13, Ivanti published an advisory for CVE-2026-104935, an authentication-bypass vulnerability in affected Connect Secure enterprise VPN versions. The flaw has a CVSS score of 8.6 and can allow an unauthenticated remote attacker to execute arbitrary commands on an affected appliance. Ivanti reports exploitation against a limited number of customers before public disclosure; CISA independently listed the vulnerability as known exploited on October 13. Rapid7 cites forensic research identifying attacker activity in early October and warns that attackers also used a separate, not-yet-patched privilege escalation flaw. Available fixes cover affected 25.1 and 22.8 code lines, and Ivanti says older 22.7.x and earlier versions are not affected. There is no verified global outage, broad victim count or established compromise of every exposed appliance.
ELI5: Plain-English Explanation
Some corporate VPN gateways have a security hole that lets outsiders run commands without logging in. Attackers used it before the public warning. Updating the software helps close the hole but may not remove an attacker already inside.
Why Urgent Level 3
The flaw affects internet-edge remote-access infrastructure, was exploited before disclosure and has a short federal remediation deadline. Patching and incident review are time-sensitive.
What Changed
Ivanti publicly disclosed CVE-2026-104935 on October 13; CISA added it to its KEV catalog that day. Exploitation preceded the announcement.
What Is Genuinely New
Verified vendor disclosure, confirmed in-the-wild exploitation, CISA KEV listing and actionable patch guidance for a distinct 2026 CVE. This is not an update to previously reported Ivanti vulnerabilities.
CHRONOS Bottom Line
Confirmed targeted zero-day exploitation warrants urgent remediation and compromise review. The affected population is not quantified; a global incident or widespread outage is not established.
Market Reality Gap
An actively exploited 8.6 CVSS flaw does not establish widespread victimization, exfiltration or service outages. A patch may stop new exploitation without proving that earlier intrusions were removed.
Negative Evidence / Invalidation
Ivanti describes a limited number of affected customers; no verified worldwide outage or total victim count; vendor fixes are available for affected code lines.
Resilience / Shock Absorbers
Patches, network segmentation, access controls, integrity checks, incident response and vendor guidance can contain risk; unaffected version branches do not require the same fix.
Watch Windows
- Next 24 hours: vendor and CISA updates, enterprise patch response
- By October 16: reported federal remediation deadline
- Next 7 days: forensic findings and newly confirmed victims
Uncertainties / Known Unknowns
- Number and identities of affected customers
- Pre-patch attacker persistence and lateral movement
- Details and fix timing for separate privilege escalation issue
- Extent of compromise beyond initially identified cases
Detailed Analysis
CVE-2026-104935 is a spoofing-related authentication bypass in Ivanti Connect Secure, scored CVSS 8.6, with potential unauthenticated command execution. Rapid7 reports Ivanti observed exploitation affecting a limited customer set and CISA listed the issue as known exploited. The affected code lines include 25.1.1.1 and earlier in the relevant branch, 25.1.2.2 and earlier, and 22.8R2.4 and earlier; vendor updates include 25.1.1.2, 25.1.3.0/25.1.3.1 and 22.8R2.5 as appropriate. Version applicability depends on hardware and branch; administrators should follow Ivanti's exact matrix. Forensics cited by Rapid7 point to activity in early October and a separate privilege escalation issue without a public patch at disclosure. Internet-facing VPN devices are attractive footholds, but no evidence establishes a generalized compromise of all deployments.
Affected Countries
- United States
- Global
Affected Industries
- Cybersecurity
- Enterprise IT
- Banking
- Healthcare
- Government
- Critical infrastructure
Affected Companies
- Ivanti
- Rapid7
Affected Assets
- Ivanti Connect Secure VPN appliances
- Enterprise remote access
- Corporate identity infrastructure
Sources / Evidence
- 01Ivanti Connect Secure security advisory CVE-2026-104935Ivanti2026-10-13
- 02CISA Known Exploited Vulnerabilities catalogCISA2026-10-13
- 03Ivanti Connect Secure zero-day exploited in the wildRapid72026-10-13
- 04Ivanti zero-day gave attackers root access to patched VPNSecurityWeek2026-10-13
Follow CHRONOS ALERTS
Published alerts also appear on Instagram and Threads as @chronosalerts.