Ivanti Connect Secure Vulnerability: CVE-2026-104935 and CISA’s Oct 16 Deadline

Last updated: October 16, 2026. By Veer. Facts checked against CISA’s October 13 alert, CISA’s KEV catalog add, the CISA KEV JSON feed (due date 2026-10-16), NVD for CVE-2026-104935, Volexity’s October 13 analysis, and eSentire’s advisory summary. Ivanti’s Hub advisory page did not return readable content to our fetch tooling on October 16; patch versions below follow CISA, Volexity and eSentire’s citations of Ivanti’s advisory.

If you run Ivanti Connect Secure (ICS) as a VPN edge appliance, treat today as a hard patch day. This is the same October 16 CISA deadline we flagged briefly in our October 2026 Patch Tuesday roundup. Below is what CVE-2026-104935 is, which builds are fixed, how attackers used it, and what to do if you think you were hit.

What is the Ivanti Connect Secure vulnerability CVE-2026-104935?

CVE-2026-104935 is an authentication bypass by spoofing in Ivanti Connect Secure that allows a remote, unauthenticated attacker to execute arbitrary commands. CISA’s KEV entry and NVD both describe it that way. NVD lists a CVSS 3.1 base score of 8.6 (High) with vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L, and CISA’s SSVC assessment marks exploitation as active, automatable and with total technical impact.

CISA says threat actors have used the bug for credential theft and data exfiltration. Ivanti, as summarized by eSentire, confirmed exploitation against a “limited number” of customers and said those customers were contacted. There was no public proof-of-concept at the time of eSentire’s October 14 write-up.

Volexity reported that Ivanti tracks the authentication bypass and remote code execution pieces of the chain under this single CVE. A separate privilege-escalation flaw was chained in the wild to reach root; Volexity says Ivanti is fixing that privilege escalation in a future release, not in the October 13 patches.

NVD’s description notes the issue affects ICS before version 25.1.3.0 and “does not impact ICS version 22.7R2.14 or prior.” Use Ivanti’s own advisory and upgrade guide for the full matrix for your appliance type.

Which Ivanti Connect Secure versions are affected?

Affected builds include ICS 25.1.1.1 and prior, 25.1.2.2 and prior, and 22.8R2.4 and prior; fixed builds are 25.1.1.2, 25.1.3.0 / 25.1.3.1, and 22.8R2.5. That matrix matches eSentire’s table citing Ivanti’s advisory, and it aligns with CISA’s affected-version list and Volexity’s upgrade guidance.

Source: eSentire advisory summary of Ivanti’s Security Advisory for CVE-2026-104935; CISA alert (affected version families); Volexity (upgrade to newest builds in the 25.1.1, 25.1.2 and 22.8R2.4 lines).

CISA also notes that Ivanti Connect Secure version 22.8 reaches end of life on January 31, 2027. If you are still on the 22.8 line, patch to 22.8R2.5 now and plan the migration off 22.8 before that EOL date. CISA points administrators to Ivanti’s Connect Secure 25.x Upgrade and Migration Compatibility Guide for hardware and virtual appliance paths.

Is CVE-2026-104935 being exploited?

Yes. CISA added CVE-2026-104935 to its Known Exploited Vulnerabilities catalog on October 13, 2026, and Volexity documented in-the-wild chaining starting around October 3, 2026. Volexity tracks the actor as UTA0576 and assesses with low confidence that motivations look more criminal than espionage, based on the target they saw.

In Volexity’s case, a fully patched (at the time) 22.8R2.4 appliance was compromised. The chain combined:

1. Authentication bypass in how welcome.cgi routes requests (including abuse of an X-DSCGI-PATH header to reach protected CGI scripts).
2. Remote code execution via a race in wu.cgi file upload handling.
3. Privilege escalation by abusing the dsinvoked broker and in-memory library patching to run as root.

Post-exploitation focused on Active Directory and LDAP credential theft (including LAPS passwords and BitLocker recovery keys), configuration and auth-log reconnaissance, password spraying, packet capture of LDAP traffic, and anti-forensics (log scrubbing, restoring in-memory patches, deleting temporary scripts). Volexity says the actor did not leave a web shell or persistent backdoor; each command re-ran the exploit chain and returned results over HTTPS.

What is CISA’s October 16 deadline?

US Federal Civilian Executive Branch agencies must remediate CVE-2026-104935 by October 16, 2026 under Binding Operational Directive 26-04. That due date is in CISA’s KEV feed. The same catalog entry also flags forensic triage: Yes, meaning agencies must check whether the system was compromised before the patch was applied, following CISA’s BOD 26-04 guidance.

CISA encourages all organizations—not only federal agencies—to prioritize KEV items. For context, CISA added two CVEs to the catalog on October 13: this Ivanti bug and CVE-2026-96951, the exploited Windows Shell / Mark of the Web zero-day covered in our Patch Tuesday guide.

How do you patch Ivanti Connect Secure?

Upgrade every affected ICS appliance to a resolved build in the table above as soon as you can schedule a maintenance window. Prefer Ivanti’s official advisory and the 25.x Upgrade and Migration Compatibility Guide for the exact path for your hardware or virtual appliance.

Practical order of operations:

1. Inventory every ICS appliance (physical and virtual), including lab and DR copies.
2. Snapshot or back up configuration using Ivanti’s supported archive/backup process before you change anything.
3. Upgrade to 25.1.1.2, 25.1.3.0/25.1.3.1, or 22.8R2.5 as appropriate for your train.
4. Confirm the running version after reboot.
5. Assume possible compromise if the appliance was internet-exposed before the patch, and decide whether you need the recovery procedure below—not only a software bump.
6. Monitor for the indicators Volexity published (for example, unusual volumes of requests to /dana-na/auth/url_default/welcome.cgi with mismatched X-DSCGI-PATH headers, and unexpected files under /tmp/).

Edge VPN appliances sit next to browsers and Windows on this week’s patch list. After ICS, finish Chrome 155 / Firefox 158 and review upcoming OS deadlines on our Windows end of support calendar.

What if you suspect compromise?

Do not rely on Ivanti’s Integrity Checker Tool alone. CISA and Volexity both warn that this exploit chain can run in memory, patch libraries only in RAM, restore configuration afterward, and scrub logs—so the Integrity Checker may not show evidence of exploitation. CISA says organizations need network and memory forensics.

If you suspect compromise, CISA recommends Ivanti’s recovery procedures in this order:

1. Create a backup of the appliance configuration (Ivanti documents binary configuration backup/restore via an archiving server).
2. Factory reset the appliance and upgrade to the latest version; for cloud and virtual systems, rebuild the instance and then upgrade.
3. Restore the configuration from the backup in step 1.
4. Reset passwords for all accounts (domain, administrator and local). Revoke and reissue stored certificates. Reset stored API keys and license server credentials.

Also treat any credentials that ever lived on the appliance—LDAP bind accounts, VPN user secrets you stored, API tokens—as potentially stolen. Rotate them in Active Directory and downstream systems, not only on the ICS box. For a broader checklist on agent and automation credential hygiene, see our AI agent security checklist.

What should businesses and MSP teams do today?

If you manage Ivanti Connect Secure for a company or for customers, treat CVE-2026-104935 like an edge-appliance emergency: patch, then decide whether a rebuild is required. Federal agencies already have a hard October 16 deadline. Private-sector teams should use the same date as a working target even when BOD 26-04 does not legally apply.

A practical triage list:

1. Internet-exposed ICS first. Anything with a public management or VPN portal goes to the front of the queue.
2. Confirm version strings from the admin UI or CLI on every node, including HA peers and standby appliances.
3. Patch or rebuild. If the box was patched after October 3 without forensics, remember Volexity’s earliest observed exploitation was October 3—being “current” before October 13 was not enough.
4. Credential blast radius. Assume LDAP service accounts, stored RADIUS/LDAP secrets, and any API keys on the appliance may have left the building.
5. Watch lateral movement. Volexity saw Kerberoasting helpers, password spraying and LDAP searches for LAPS and BitLocker data. Hunt for those patterns from the VPN subnet.
6. Document the change window. Keep the pre-upgrade config backup offline so you can rebuild cleanly if Integrity Checker stays quiet but network evidence looks bad.

Home users almost never run Connect Secure. If that is you, this CVE is still a reminder to finish the consumer side of this week’s patch wave: Windows (Patch Tuesday), browsers (Chrome 155), and phone OS updates such as iOS 26.7.1.

How can you monitor for exploitation?

Volexity recommends watching for large numbers of requests to /dana-na/auth/url_default/welcome.cgi that carry an X-DSCGI-PATH header pointing at protected scripts or temporary paths. Examples from its report include headers aimed at /home/webserver/htdocs/dana/fb/smb/wu.cgi or /home/runtime/tmp/<MD5(filename)>. Mismatches between the URL path and X-DSCGI-PATH are especially interesting.

On a host you can still image, Volexity also points responders at:

• Unexpected scripts or JSON under /tmp/ (its investigation saw LDAP and Kerberos helper scripts and exfil bundles there)
• Hidden capture tooling under paths such as /data/.icscap/
• Evidence of log truncation in Ivanti debug logs and Linux audit logs
• Memory artifacts, because disk integrity tools may miss in-memory patches

Share indicators with your SOC or IR firm rather than posting exploit details into a public ticket. If you only have SIEM access to the VPN, start with the welcome.cgi / header mismatch hunt and unusual outbound LDAP or SMB from the appliance.

Timeline: Ivanti Connect Secure CVE-2026-104935

Disclosure and the federal deadline both land in the same week: exploitation observed from October 3, public advisory and CISA KEV on October 13, FCEB due date October 16, 2026.

FAQ

What is the Ivanti Connect Secure vulnerability?

The Ivanti Connect Secure vulnerability CVE-2026-104935 is an authentication bypass by spoofing that lets a remote unauthenticated attacker execute arbitrary commands on affected ICS appliances. CISA and NVD classify it as actively exploited; NVD scores it CVSS 8.6.

What is CISA’s deadline for CVE-2026-104935?

CISA’s Known Exploited Vulnerabilities catalog sets a remediation due date of October 16, 2026 for Federal Civilian Executive Branch agencies. The CVE was added to the catalog on October 13, 2026. CISA still urges every organization running affected ICS to patch immediately.

Which Ivanti Connect Secure versions should I upgrade to?

Upgrade 25.1.1.x lines to 25.1.1.2, 25.1.2.x lines to 25.1.3.0 or 25.1.3.1, and 22.8R2.4 and prior to 22.8R2.5. Confirm the exact path in Ivanti’s advisory and the 25.x upgrade guide for your appliance type.

Does Ivanti’s Integrity Checker detect this attack?

Not reliably. CISA and Volexity both warn that threat actor commands can execute in memory and that the Integrity Checker Tool may not show evidence of CVE-2026-104935 exploitation. Use network and memory forensics if you suspect compromise.

Is the privilege escalation fixed in the October 13 patches?

No. Volexity says Ivanti patched the authentication bypass and RCE under CVE-2026-104935 on October 13, 2026, while a separate privilege-escalation bug used in the wild will be fixed in a future release. Patch now anyway—the disclosed CVE already enables unauthenticated command execution.

What should I do after patching if the VPN was internet-facing?

Follow Ivanti’s recovery sequence if compromise is possible: back up config, factory reset or rebuild, restore config, then reset all passwords, certificates and API keys. Rotate any Active Directory or service credentials that the appliance could reach, and review authentication and VPN logs for unusual activity.

Sources

• CISA, CISA Urges Patching Newly Exploited Vulnerability in Ivanti Connect Secure (October 13, 2026)
• CISA, CISA Adds Two Known Exploited Vulnerabilities to Catalog (October 13, 2026)
• CISA, Known Exploited Vulnerabilities Catalog JSON feed (CVE-2026-104935 due date 2026-10-16; checked October 16, 2026)
• NIST NVD, CVE-2026-104935 (CVSS 8.6; description; checked October 16, 2026)
• Volexity, A Series of Unauthenticated Events: Chained Exploitation of Ivanti Connect Secure Zero-Days (October 13, 2026)
• eSentire, Ivanti Connect Secure Zero-Day Vulnerability (CVE-2026-104935) (October 14, 2026)
• Ivanti, Security Advisory: Ivanti Connect Secure CVE-2026-104935 (primary vendor page; not fully readable via our fetch on October 16—cite CISA/Volexity/eSentire for patch matrix)
• TrustLoud, October 2026 Patch Tuesday and Chrome Security Update October 2026