Ivanti Connect Secure Zero-Day Chain: CVE-2026-104935

Ivanti Connect Secure was hit by a three-flaw zero-day chain that gave unauthenticated attackers root on fully patched VPN appliances. The chain pairs an authentication bypass and RCE (CVE-2026-104935, CVSS 8.6) with a privilege escalation (CVE-2026-111357) and a predictable file-upload flaw (CVE-2026-118527). All three are in CISA's Known Exploited Vulnerabilities catalog, so upgrade to ICS 25.1.1.3 or 22.8R2.6 now.

Volexity found the chain in the first week of October 2026 while investigating suspicious activity at a customer, and traced it to an Ivanti Connect Secure (ICS) VPN appliance that was fully patched at the time, running 22.8R2.4. The threat actor, which Volexity tracks as UTA0576, combined the three bugs to go from no credentials to root. Ivanti shipped a fix for the primary entry point, CVE-2026-104935, in October, and released patches for the other two flaws on October 29, according to BleepingComputer and The Hacker News.

What makes this campaign unusual is what the attacker did not do. According to Volexity's write-up, UTA0576 deployed no web shell and no malware. It re-ran the exploit for every command, passed commands and output through the exploit's own HTTPS requests, and deleted evidence from Ivanti debug logs and Linux audit logs. That approach evaded Ivanti's Integrity Checker Tool, and Volexity needed memory images and core dumps to reconstruct the chain. Once inside, the actor went after Active Directory credentials, LAPS passwords and BitLocker recovery keys.

How does the Ivanti Connect Secure exploit chain work?

The chain starts with CVE-2026-104935, an authentication bypass by spoofing (CWE-290) that NVD describes as letting a remote unauthenticated attacker execute arbitrary commands on ICS before 25.1.3.0. It carries a CVSS score of 8.6 and an EPSS score in the 99.7th percentile. From there, CVE-2026-111357 (CVSS 7.0 per NVD, CWE-829) abuses how the dsinvoked broker trusts DSCache configuration data to escalate to root. CVE-2026-118527, a predictable-identifier flaw Ivanti rates 4.3, lets an authenticated attacker upload attacker-controlled files to a known location on disk. Individually, two of these look moderate. Chained, they are unauthenticated root on an internet-facing gateway.

Which Ivanti Connect Secure versions are affected and fixed?

Ivanti's fixed releases are 25.1.1.3 (for 25.1.1.2 and earlier) and 22.8R2.6 (for 22.8R2.5 and earlier). Ivanti says the latest release addresses every vulnerability in the chain. Shadowserver tracks more than 5,000 internet-exposed ICS instances, and there is no public figure on how many have been patched.

How do you check whether your Ivanti VPN was compromised?

Patching closes the door but does not tell you whether someone already came through it. Because UTA0576 left no web shell and scrubbed logs, a clean Integrity Checker result is not proof of a clean device. Volexity's advice is to forensically investigate any appliance showing signs of compromise, such as lateral movement attempts that originate from the VPN device itself. Practically, that means reviewing authentication logs on domain controllers for activity sourced from the VPN appliance, rotating any credentials, LAPS passwords and BitLocker keys the appliance could have reached, and treating the appliance as untrusted until it has been rebuilt on a fixed version.

Our read

Two of the three bugs in this chain would not top anyone's patch queue on their own: a local privilege escalation and a 4.3 file-upload flaw. The lesson is that severity is a property of the path, not the individual CVE. A defender ranking findings one at a time by CVSS would have deferred exactly the pieces that turned an auth bypass into root. Exercising the exposed path the way an attacker would, then confirming the fix actually landed on every appliance, is what catches that. It is also a reminder that edge devices which do not run your EDR need their own evidence trail, because this actor's whole tradecraft was built around leaving none. For how to weigh chained and exploited flaws, see our guide to prioritizing vulnerabilities with CVSS, EPSS and KEV and what the CISA KEV catalog is. For why patched-at-the-time appliances still fall, see what a zero-day vulnerability is. To test what an attacker can reach through your own exposed services, Nexus Void runs VAPT on web apps, APIs and mobile apps.

Reporting by BleepingComputer, The Hacker News and Volexity; CVSS, EPSS and KEV dates per NVD, FIRST and the CISA KEV catalog.

Frequently asked questions

What is CVE-2026-104935?
It is an authentication bypass by spoofing in Ivanti Connect Secure before 25.1.3.0 (CVSS 8.6, CWE-290) that lets a remote unauthenticated attacker execute commands. It was exploited as a zero-day and added to CISA KEV on October 13, 2026.

Is the Ivanti Connect Secure chain being exploited?
Yes. Volexity observed a threat actor it calls UTA0576 chaining all three flaws since early October 2026, and CISA has added all three CVEs to the Known Exploited Vulnerabilities catalog.

Which Ivanti Connect Secure version fixes the chain?
Upgrade to 25.1.1.3 or 22.8R2.6. Ivanti says the latest release fixes every vulnerability used in the chain.

Will the Ivanti Integrity Checker Tool detect this attack?
Not reliably. The attacker deployed no web shell or malware and tampered with logs, which evaded the Integrity Checker Tool, so a forensic review is needed for any appliance showing suspicious activity.

What did the attackers steal?
Volexity reported the actor targeted Active Directory credentials and metadata, LAPS passwords and BitLocker recovery keys, so rotate anything the VPN appliance could reach.