Ivanti shipped fixes on October 13, 2026 for CVE-2026-104935, an authentication bypass by spoofing in Ivanti Connect Secure (ICS) rated CVSS 8.6. Volexity reported it after observing in-the-wild exploitation by a criminally motivated cluster it tracks as UTA0576. CISA added the flaw to the Known Exploited Vulnerabilities catalog the same day with a federal deadline of October 16, a three-day window.

The bigger problem is the chain. Per Volexity’s findings as relayed in vendor and press reporting, the bypass was used together with a separate privilege escalation bug to reach root on the appliance. Ivanti has said a fix for that third bug will follow “in the coming weeks.” Several outlets report it remains unpatched on all current ICS firmware as of October 14, though accounts of the exact chain differ, so treat the specifics below as reported, not independently verified.

What happened

  • October 1: Defused Cyber reports pre-disclosure exploit activity.
  • October 3: Volexity reports first observing exploitation by UTA0576.
  • October 13: Ivanti releases patches and credits Volexity; CISA adds CVE-2026-104935 to KEV.
  • October 14: Honeypot operators report roughly 105 exploit attempts, and watchTowr publishes analysis and an FAQ.

Technical details

CVE-2026-104935 is an authentication bypass by spoofing: a remote, unauthenticated attacker can present spoofed identity data to the appliance and be treated as an authenticated principal, which in turn exposes functionality that permits arbitrary command execution. In the observed chain, the bypass supplies the foothold and a second, unpatched local privilege escalation converts it to root. Exact request paths and parameters have not been confirmed by Ivanti; refer to the watchTowr write-up and the Ivanti advisory for the primary technical detail.

ICS is an internet-facing VPN gateway that terminates remote-access sessions and holds credentials, session tokens, and routes into internal networks. Root on the appliance means an attacker can harvest credentials, tamper with the integrity checker, and persist across upgrades if they plant implants before patching. Ivanti ICS has a long record of this pattern, including the 2024 chain of CVE-2023-46805 and CVE-2024-21887 and the 2025 flaws CVE-2025-0282 and CVE-2025-22457.

Affected and fixed versions

Per Ivanti’s guidance as reported:

BranchAffectedFixed
22.822.8R2.4 and earlier22.8R2.5 (Ivanti advises moving to 25.1.1.2; 22.8 reaches end of life January 31, 2027)
25.1 (ISA6000/ISA8000)25.1.1.1 and earlier25.1.1.2
25.125.1.2.2 and earlier25.1.3.0 or 25.1.3.1

Ivanti states 22.7R2.14 and earlier are not affected, although at least one vulnerability database lists them. Sources disagree on some fixed-version numbers, so confirm against Ivanti’s advisory before scheduling the change.

Impact

Any internet-exposed ICS appliance on an affected build should be assumed targeted. Because exploitation began at least ten days before the patch and the root escalation remains open, a patched appliance is not necessarily a clean one. Criminally motivated actors in this class typically pursue credential theft, lateral movement into Active Directory, and ransomware staging.

Mitigation

  1. Patch now to the fixed build for your branch. Do not wait for the privilege escalation fix.
  2. Run Ivanti’s Integrity Checker Tool (ICT) and take an external ICT scan; preserve a snapshot first. A factory reset is the safe response if there is any sign of compromise.
  3. Hunt back to October 1: review auth logs for sessions from unexpected source IPs without a corresponding identity-provider event, unusual admin-API calls, new or modified files, and unexpected outbound connections from the appliance.
  4. Rotate credentials that transit or are stored on the appliance: LDAP/AD service accounts, certificates, API keys, and user secrets, if compromise is suspected.
  5. Reduce exposure: restrict management interfaces to a dedicated network, and put the gateway behind upstream filtering where feasible.
  6. Plan the 22.8 migration; the branch is nearing end of life and Ivanti’s own guidance is to move to 25.1.

References