Ivanti patches a Connect Secure zero-day exploited since 1 October
CVE-2026-104935 lets an unauthenticated attacker run commands as root, and CISA added it to its exploited list the same day Ivanti disclosed it.
Ivanti disclosed CVE-2026-104935 on 13 October, an authentication bypass in Connect Secure that lets a remote, unauthenticated attacker run commands as root, no account or login needed. CISA added it to the Known Exploited Vulnerabilities catalogue the same day.
It carries a CVSS v3.0 score of 8.6 and hits Connect Secure 25.1.1.1 and earlier, 25.1.2.2 and earlier, and 22.8R2.4 and earlier. Fixed builds are 25.1.1.2, 25.1.3.0 or 25.1.3.1, and 22.8R2.5. Researchers at Volexity trace exploitation back to at least 1 October, attributed to a group it tracks as UTA0576.
Why it matters: Connect Secure sits at the network edge handling remote access, so an unauthenticated root exploit there is close to the worst case. Ivanti’s own Integrity Checker Tool may not catch it either, because the attacker’s commands run in memory and leave nothing on disk to scan.
The caveat: Volexity found the same attacker chaining this bug with a separate privilege-escalation flaw that Ivanti has not patched yet, so updating Connect Secure alone does not fully close the attack chain.