securitytabs

LiveUpdated

Ivanti Connect Secure authentication bypass exploited as zero-day

Ivanti disclosed CVE-2026-104935, an authentication bypass in Connect Secure that was exploited before disclosure. CISA added it to its KEV catalogue and urges patching.

Written and kept up to date by the SecurityTabs AI newsroom from 3 outlets, and published automatically. Each paragraph cites its sources. CVSS, EPSS and KEV status below come directly from NVD, FIRST and CISA, not from the AI.

Vulnerabilities

What happened

Rapid7 says Ivanti published a security advisory on October 13, 2026 for CVE-2026-104935, an authentication bypass by spoofing in Ivanti Connect Secure that lets a remote, unauthenticated attacker execute arbitrary commands. Ivanti reports exploitation in the wild occurred before disclosure, affecting a limited number of customers, according to Rapid7. [1]

CISA's alert lists the affected Connect Secure versions and urges organizations with affected appliances to act. [2]

Exploitation

CISA says it is aware of threat actors exploiting the zero-day to conduct credential theft and data exfiltration. It added the flaw to its Known Exploited Vulnerabilities catalogue on October 13. [2][3]

Dark Reading reports the vulnerability, described as an authentication bypass plus remote code execution, was only partially discovered and patched in July, leaving an opening for attackers. [4]

Severity and unknowns

Rapid7 cites a CVSS score of 8.6. The sources reviewed do not name the attackers, and the number of affected customers has been described only as limited. [1][2]

Business Action

What this means inside your organization, and what to do about it, by company size.

Small business

No dedicated security staff; relies on providers

What to know

Businesses that use Ivanti Connect Secure, often through an MSP or provider, are exposed to a flaw that attackers have exploited to steal credentials and data. [2]

What to do

  1. Ask your IT provider whether you use Ivanti Connect Secure and whether it has been updated per Ivanti's advisory. [2][1]
  2. Ask the provider whether the appliance has shown signs of compromise, given the credential theft CISA describes. [2]

Mid-size company

A small IT or security team

What to know

CISA published a list of affected Connect Secure versions and urges action on affected appliances. [2]

What to do

  1. Inventory Connect Secure appliances and compare their versions with those in CISA's alert. [2]
  2. Apply the fix described in Ivanti's advisory and follow CISA's guidance. [2][1]
  3. Consider credentials that passed through affected appliances at risk, since CISA reports credential theft. [2]

Large enterprise

A security operations team

What to know

Exploitation began before disclosure and CISA reports credential theft and data exfiltration, so patching alone may not address prior compromise. [2][1]

What to do

  1. Identify all Connect Secure deployments and versions and prioritise patching per Ivanti's advisory and CISA's guidance. [2]
  2. Hunt for signs of unauthorised command execution and data exfiltration on affected appliances. [2][1]
  3. Review the July Ivanti fixes in light of Dark Reading's report that the issue was only partially patched. [4]

Timeline

  1. Dark Reading reported the flaw had been only partially patched in July. [4]

  2. CISA added CVE-2026-104935 to its Known Exploited Vulnerabilities catalogue and urged patching. [2][3]

  3. Ivanti published an advisory for CVE-2026-104935 and reported exploitation before disclosure. [1]

  4. · CISA KEV

    CISA added CVE-2026-104935 to its Known Exploited Vulnerabilities catalog.

  5. · coverage

    Earliest coverage cited in this report: CISA Advisories. [2]

Sources

  1. [1]Rapid7 Blog · Oct 13, 17:06 UTC
    Ivanti Connect Secure zero-day exploited in the wild (CVE-2026-104935)context
  2. [2]CISA Advisories · Oct 13, 12:00 UTC
    CISA Urges Patching Newly Exploited Vulnerability in Ivanti Connect Securecontext
  3. [3]CISA Advisories · Oct 13, 12:00 UTC
    CISA Adds Two Known Exploited Vulnerabilities to Catalogcontext
  4. [4]Dark Reading · Oct 14, 21:20 UTC
    Ivanti ICS Zero-Day Attacks Highlight Vendor Patching Hurdlescontext