Enterprise IT management firm Ivanti has disclosed a high-severity authentication bypass vulnerability in its Ivanti Connect Secure VPN platform, warning that exploitation is already underway in the wild.
CVE-2026-104935 has a CVSS score of 8.6 and could allow a remote attacker to execute code on affected systems without valid credentials.
The issue impacts the following versions:
- 25.1.1.1 and prior
- 25.1.2.2 and prior
- 22.8R2.4 and prior
The issue is resolved in versions 25.1.1.2, 25.1.3.0, 25.1.3.1, and 22.8R2.5. The vendor has confirmed that versions 22.7.x and below are unaffected.
The US Cybersecurity and Infrastructure Security Agency (CISA) and several analysts have already had a look at the activity and are warning that urgent patching is advised.
“CISA is aware of Ivanti’s disclosure of a newly exploited vulnerability, CVE-2026-104935, affecting Ivanti Connect Secure versions 25.1.1.1 and prior, 25.1.2.2 and prior, and 22.8R2.4 and prior,” the US cyber agency said overnight.
“CISA is aware of cyber threat actors exploiting this zero-day authentication bypass vulnerability, which allows remote, unauthenticated execution of arbitrary commands, to conduct credential theft and data exfiltration.”
The CVE has already been added to CISA’s Known Exploited Vulnerabilities Catalog.
Cyber security firm Volexity already has a blog post describing the activity, with the company explaining that an unknown threat actor is chaining several vulnerabilities together to achieve compromise.
“In the first week of October 2026, Volexity discovered an unknown threat actor, UTA0576, abusing a zero-day exploit chain to compromise a fully patched (at the time, version 22.8R2.4) Ivanti Connect Secure (ICS) VPN appliance,” Volexity said.
“This exploit chain combined an authentication bypass, a remote code execution (RCE), and a privilege escalation vulnerability to achieve unauthenticated root-level code execution.”
According to Volexity, the threat actor is seeking Local Administrator Password Solution (LAPS) passwords and BitLocker recovery keys. Cyber security firm Rapid7 is also on the case, particularly in light of Ivanti’s popularity.
“Ivanti Connect Secure is a popular enterprise VPN solution and naturally sits on the edge of a corporate environment. The product has a history of being targeted by attackers, with zero-day exploitation of other vulnerabilities occurring back in both 2024 and 2025,” Rapid7 said in a 13 October blog post.
“Given the confirmed exploitation, the ability to execute commands without authentication, along with the history of the product, Rapid7 recommends that organisations running affected versions apply the appropriate update on an emergency basis outside of normal patching cycles.”
Yordan Ganchev, principal threat intelligence specialist at exposure management firm watchTowr, has a slightly more colourful take on the vulnerability and its exploitation.
“It’s our favourite time of the month, and Ivanti has kicked off Patch Tuesday with a bang,” Ganchev told Cyber Daily.
“The root cause of the vulnerability is incredibly simple, with a single request containing a specially crafted ‘X-DSCGI-PATH’ header being all that is needed to bypass authentication and access sensitive functionality that otherwise should be restricted.
“Ivanti Connect Secure has long been a popular target for attackers, including ransomware gangs, and joins 14 other Ivanti Connect Secure / Pulse Connect Secure vulnerabilities on the CISA KEV list.
“Given the history, we expect exploitation to move incredibly quickly from targeted attacks to indiscriminate mass exploitation.”
Want to see more stories from trusted news sources?Make Cyber Daily a preferred news source on Google.
