Covered by 2 outlets — first reported by Volexity, Oct 13, 15:32 UTC
A Series of Unauthenticated Events: Chained Exploitation of Ivanti Connect Secure Zero-Days
MentionsIvantiIvanti Connect Secure
In brief
Overview On October 13, 2026, Ivanti published a security advisory for CVE-2026-104935 , a high-severity authentication bypass by spoofing ( CWE-290 ) affecting Ivanti Connect Secure (ICS). The vulnerability has a CVSSv3.0 score of 8.6 and allows a remote, unauthenticated attacker to execute arbitrary commands.
From Rapid7 Blog's coverage.
Continue reading
2 outlets, in the order they reported it.
VolexityFirst report
A Series of Unauthenticated Events: Chained Exploitation of Ivanti Connect Secure Zero-Days
[Update: At the time of publication, Ivanti was in the process of developing a patch for the privilege escalation vulnerability described in this blog post. On October 29, 2026, Ivanti
Rapid7 Blog
Ivanti Connect Secure zero-day exploited in the wild (CVE-2026-104935)
Overview On October 13, 2026, Ivanti published a security advisory for CVE-2026-104935 , a high-severity authentication bypass by spoofing ( CWE-290 ) affecting Ivanti Connect Secure (ICS).
Explained
The technology and terms in this story. Learn more
- ConceptZero-dayA flaw attackers exploit before the vendor has a fix: defenders have had zero days to patch.
- AttackPrivilege escalationGoing from limited access to more powerful access, such as from a normal user to administrator.
- WeaknessAuthentication bypassA flaw that lets someone in without valid credentials.
- TechnologyOT / ICS · Operational technology / industrial control systemsThe computers that run physical processes: factories, power grids, water plants, building systems.
Why it was possible
The weaknesses behind this story's CVEs, from each CVE Record.