A remote attacker with no login can trick the gateway about who is sending a request and then run commands on it. CISA lists the flaw as exploited, and Ivanti says it knew of attacks on a limited number of customers when it disclosed the flaw.
What it allows
A remote attacker with no account and no user action can run arbitrary commands on an affected Connect Secure gateway. Ivanti rates the flaw 8.6 (High) and NVD carries the same score for the CVSS v3.1 vector AV:N/AC:L/PR:N/UI:N. CISA's scoring data in the NVD record marks exploitation as active, the attack as automatable and the technical impact as total. A gateway sits at the edge of the network, so a compromise there gives an attacker a starting point.
Who is affected
Per the Ivanti advisory, these versions are affected: 25.1.1.1 and earlier, 25.1.2.2 and earlier, and 22.8R2.4 and earlier. Fixed versions are 25.1.1.2 (released 5 October 2026), 25.1.3.0 and 25.1.3.1, and 22.8R2.5 (released 12 October 2026). Version 22.7R2.14 and earlier does not contain the flaw, according to Ivanti and NVD.
On 29 October 2026, Ivanti added two CVEs to the same advisory. Ivanti says the exploitation it knows of happened when CVE-2026-104935, CVE-2026-111357 and CVE-2026-118527 are chained. For both new CVEs, Ivanti lists 25.1.1.2 and earlier and 22.8R2.5 and earlier as affected, with fixes in 25.1.1.3 and 22.8R2.6.
CVE-2026-111357 is the privilege escalation that gave the attacker root access. Ivanti rates it 8.8 (High), while the score in the NVD record, supplied by MITRE, is 7.0 (High). Per Ivanti, CVE-2026-118527 uses predictable filenames, so an authenticated attacker can upload files to a known place on disk. Ivanti rates it 4.3 (Medium); there was no NVD record for it as of 30 October 2026.
Ivanti says it found part of the flaw itself and fixed it in release 25.1.3.0 in July 2026. It was still moving the fix back to the other supported versions when attacks began. Moving to 25.1.3.0 needs the newer ISA4500, ISA6500 or ISA8500 platform. Both 22.7 and 22.8 reach end of life on 31 January 2027, and Ivanti tells customers to move to the 25.1 line before then.
CISA added the flaw to the Known Exploited Vulnerabilities (KEV) catalog on 13 October 2026 with a due date of 16 October 2026. The KEV entry shows ransomware use as Unknown and marks forensic triage as required. CISA added CVE-2026-111357 and CVE-2026-118527 to the KEV catalog on 30 October 2026, due 2 and 13 November 2026. Ivanti says exploitation touched a limited number of customers at disclosure and that few indicators of compromise exist so far.
Volexity, which reported the chain to Ivanti, tracks the attacker as UTA0576, an unknown threat actor. It says exploitation began on 3 October 2026 against an appliance running 22.8R2.4, then the latest version. Volexity saw theft of stored credentials, searches for LAPS passwords and BitLocker recovery keys, and password spraying. It assesses with low confidence that the motive is criminal rather than espionage.
Earlier Ivanti Connect Secure flaws also reached the KEV catalog. The authentication bypass CVE-2023-46805 and the command injection CVE-2024-21887 were both added on 10 January 2024. The stack overflow CVE-2025-0282 followed on 8 January 2025, and the buffer overflow CVE-2025-22457 on 4 April 2025. CVE-2026-104935 is the newest of the five.
Ivanti's mobile management server had its own critical flaw in 2026. Ivanti EPMM code injection CVE-2026-1281 is an unauthenticated code injection that CISA added to its KEV catalog on 29 January 2026.
Timeline
- July 2026
Ivanti releases Connect Secure 25.1.3.0, which already fixes part of the flaw.
- 5 Oct 2026
Ivanti releases 25.1.1.2, a fixed version for the 25.1.1 line.
- 12 Oct 2026
Ivanti releases 22.8R2.5, a fixed version for the 22.8 line.
- 13 Oct 2026
Ivanti publishes its advisory and says it knows of exploitation. NVD publishes the record. CISA adds the flaw to the KEV catalog.
- 16 Oct 2026
CISA due date for federal agencies to apply the vendor's mitigations.
- 29 Oct 2026
Update: Ivanti adds CVE-2026-111357 (root privilege escalation) and CVE-2026-118527 to its advisory as part of the exploited chain, fixed in 25.1.1.3 and 22.8R2.6. Volexity updates its write-up.
- 30 Oct 2026
CISA adds CVE-2026-111357 and CVE-2026-118527 to the KEV catalog, with due dates of 2 and 13 November 2026.
What to do
-
Update to a fixed version
Move 25.1.1.2 and earlier to 25.1.1.3, and 22.8 releases to 25.1.1.3 (or 22.8R2.6 if you cannot move yet); per Ivanti, these also fix CVE-2026-111357 and CVE-2026-118527. Move 25.1.2.2 and earlier to 25.1.3.0 or 25.1.3.1 (this needs the ISA4500, ISA6500 or ISA8500 platform). Plan the move off 22.8 and 22.7 to the 25.1 line before 31 January 2027.
-
Find every gateway
List each Connect Secure appliance, physical, virtual or cloud, with its version. Check which ones are reachable from the internet, since those face the most risk.
-
Run the Integrity Checker Tool
Ivanti points customers to its Integrity Checker Tool and asks them to run it regularly. Volexity says the tool did not detect this chain, because the exploit changes code in memory only. Run it on every gateway, but do not treat a clean result as proof.
-
Hunt for signs of access
CISA marks forensic triage as required for this entry. Volexity advises watching for many requests to welcome.cgi whose X-DSCGI-PATH header names a different script, and checking /tmp/ for leftover files. The attacker in its case edited the debug and audit logs, so memory and network evidence matter.
-
If you suspect a compromise
Follow the recovery steps in the Ivanti advisory. Treat credentials and keys stored on the gateway as exposed and replace them after the rebuild.
Frequently Asked Questions
What is CVE-2026-104935?
It is an authentication bypass by spoofing (CWE-290) in Ivanti Connect Secure. A remote attacker with no login can run arbitrary commands on the gateway. Ivanti and NVD rate it 8.6 (High).
Which Connect Secure versions are affected?
Ivanti lists 25.1.1.1 and earlier, 25.1.2.2 and earlier, and 22.8R2.4 and earlier. Version 22.7R2.14 and earlier does not contain the flaw. Fixed versions are 25.1.1.2, 25.1.3.0, 25.1.3.1 and 22.8R2.5. Ivanti now points the 25.1.1 and 22.8 lines to 25.1.1.3 or 22.8R2.6, which also fix CVE-2026-111357 and CVE-2026-118527.
Is CVE-2026-104935 being exploited?
Yes. Ivanti says it knows of exploitation against a limited number of customers, and CISA added the flaw to the KEV catalog on 13 October 2026. It is one of nine flaws listed in our CISA KEV roundup for 13 to 16 October 2026.
Has anyone been named as the attacker?
Volexity, which found the attacks, tracks the attacker as UTA0576, an unknown threat actor. It assesses with low confidence that the motive is criminal. Neither the Ivanti advisory nor the CISA entry names an attacker, and the KEV ransomware field shows Unknown.
Sources
- Security Advisory Ivanti Connect Secure (CVE-2026-104935)Ivanti
- CVE-2026-104935 recordNIST NVD
- CISA Adds Two Known Exploited Vulnerabilities to CatalogCISA
- Known Exploited Vulnerabilities catalogCISA
- A Series of Unauthenticated Events: Chained Exploitation of Ivanti Connect Secure Zero-DaysVolexity
- CVE-2026-111357 recordNIST NVD
