Ivanti Connect Secure zero-day exploited in the wild (CVE-2026-104935)

What it is

CVE-2026-104935 is an authentication bypass by spoofing (CWE-290, CVSS 8.6) in Ivanti Connect Secure (ICS). A remote, unauthenticated attacker can use it to run arbitrary commands. Ivanti disclosed it on October 13, 2026. CISA added it to KEV the same day.

How it works

The page gives no technical mechanism beyond the CWE class. Volexity detected the threat actor in early October 2026. The actor used this flaw as a zero-day together with a separate privilege escalation vulnerability that is still unpatched. Ivanti plans to patch that second flaw later.

Preconditions / Affected

• Versions 22.7.x and below are unaffected, per the vendor advisory.
• Ivanti found part of the flaw through its own product security program and fixed it in 25.1.3.0 (July 2026). Exploitation happened while the fix was being backported to the other supported versions.
• The page's affected/resolved version table is missing from the fetched text. Check Ivanti's advisory for the fixed build for your release train.
• ICS sits at the network edge. It was hit by zero-days in 2024 and 2025 as well.

What to do

1. Patch on an emergency basis, outside the normal cycle, using Ivanti's advisory for your version.
2. Hunt for compromise using Volexity's published IOCs. Ivanti says it has no reliable IOCs of its own.
3. Hunt even after patching. Rapid7 says the patch does not tell you whether the appliance was already compromised.
4. If you suspect exploitation, follow Ivanti's recovery steps.
5. Rapid7 Exposure Command, Vulnerability Management and Nexpose customers should get a vulnerability check in the October 14 content release.

Caveats

• The second flaw in the chain, the privilege escalation, has no patch yet. Updating therefore does not fully close the chain.
• The page links to Volexity's IOCs but does not reproduce them.
• Exploitation is described only as affecting "a limited number of customers".