Ivanti Connect Secure — CISA Issues Urgent Warning Over Active Zero-Day Exploitation in Remote Command Execution Flaw (CVE-2026-104935)

Publication date: October 14, 2026
Category: News / Zero Days

Introduction

The U.S. Cybersecurity and Infrastructure Security Agency (CISA), alongside software vendor Ivanti, has issued an urgent advisory urging security teams and network administrators to immediately patch a critical vulnerability affecting Ivanti Connect Secure (ICS) gateways. Tracked as CVE-2026-104935, this security flaw has been actively exploited in the wild as a zero-day attack since at least October 1, 2026. Threat intelligence findings attribute these attacks to a threat actor tracked as UTA0576, who chains this vulnerability with privilege escalation and in-memory execution techniques to harvest corporate credentials and sensitive Active Directory data.

What is CVE-2026-104935? (General Analysis)

CVE-2026-104935 is an authentication bypass vulnerability caused by spoofing in Ivanti Connect Secure versions prior to 25.1.3.0. This flaw allows a remote, unauthenticated attacker to craft low-complexity requests that bypass the gateway’s control checks, resulting in the execution of arbitrary operating system commands.

Official NVD data assigns this vulnerability a base CVSS v3.1 score of 8.6 (HIGH) with the exact vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L. The official CWE classification is CWE-290 (Authentication Bypass by Spoofing). Due to confirmed active exploitation in real-world attacks, CISA has formally added this CVE to its Known Exploited Vulnerabilities (KEV) catalog.

How Does It Work? (Technical Analysis)

Threat intelligence analysis reveals a highly sophisticated multi-stage exploitation mechanism deployed by the UTA0576 threat group:

  • Initial Access and Authentication Bypass: The attacker exploits the spoofing vulnerability in the ICS web component (CVE-2026-104935) without needing prior credentials or user interaction (AV:N/AC:L/PR:N/UI:N), establishing an immediate entry point into the perimeter appliance.
  • In-Memory Execution and Attack Chaining: The identified campaign chains this bypass with remote code execution (RCE) and privilege escalation flaws. Crucially, the threat actor’s commands execute directly within system memory (RAM). This behavior prevents traditional file-integrity checking mechanisms, such as Ivanti’s Integrity Checker Tool, from detecting persistence on the underlying file system.
  • Post-Exploitation and Exfiltration: Once root-level privileges are attained, the threat actor engages in extensive reconnaissance targeting Active Directory credentials, Local Administrator Password Solution (LAPS) passwords, and BitLocker recovery keys to facilitate lateral movement across the internal enterprise network.

Affected Systems / Environments

The vulnerability directly impacts Ivanti perimetral security solutions. Below are the vulnerable software versions alongside a comparative table of notable historical CVEs affecting the platform:

  • Vulnerable Versions: Ivanti Connect Secure (ICS) versions prior to 25.1.3.0 (note: ICS versions 22.7R2.14 or earlier are not impacted).
  • Internet Exposure: Internet threat intelligence monitors like Shadowserver track over 5,600 publicly exposed hosts displaying ICS fingerprints.
CVE Category (CWE) Impact CVSS Vector (summary)
CVE-2026-104935 CWE-290 (Authentication Bypass) Command execution / Credential harvesting 8.6 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L
CVE-2023-46805 CWE-287 (Improper Authentication) Web access control bypass 8.2 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N
CVE-2024-21887 CWE-77 (Command Injection) Remote command execution as admin 9.1 AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
CVE-2025-0282 CWE-121 / CWE-787 (Buffer Overflow) Unauthenticated remote code execution 9.0 AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H

Mitigation and Detection

Remediation

Organizations operating affected Ivanti Connect Secure appliances must take immediate corrective action as mandated by CISA and the vendor:

  1. Immediate Patching: Promptly apply official software updates provided by Ivanti (versions 22.8R2.5, 25.1.3.0, 25.1.3.1, or 25.1.1.2 as applicable).
  2. Compromised Appliance Protocol: If signs of compromise or exposure during the zero-day window are identified, organizations must execute a factory reset of the physical appliance (or rebuild virtual instances in cloud environments), restore configuration settings from a clean pre-incident backup, and perform an extensive reset of all credentials—including domain accounts, local administrators, stored certificates, API keys, and license server credentials.

Detection

Defensive teams (Blue Teams) must implement advanced memory and network forensic techniques, as standard on-disk integrity checks remain insufficient against memory-resident threats.

“Because threat actor commands execute directly in memory, Ivanti’s Integrity Checker Tool may fail to flag signs of exploitation for CVE-2026-104935, necessitating deep memory forensics and thorough Active Directory audits.”

  • Traffic and Log Auditing: Inspect inbound network traffic for anomalies in SAML authentication flows and unusual HTTP requests targeting VPN web components.
  • Lateral Movement Monitoring: Monitor for suspicious Active Directory credential access, anomalous LAPS queries, and unauthorized attempts to retrieve BitLocker recovery keys following perimeter security events.

Wrapping Up

The active exploitation of the CVE-2026-104935 zero-day vulnerability in Ivanti Connect Secure highlights the acute risk perimeter VPN gateways introduce when leveraged as initial footholds for espionage and bulk credential theft. The ability of the UTA0576 threat group to operate entirely within memory and bypass standard integrity validation forces network defenders to adopt robust defense-in-depth measures, prioritizing emergency patching under strict regulatory timelines alongside continuous forensic monitoring of enterprise identity stores.

References