Full Report
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) urged security teams to immediately patch an Ivanti Connect Secure (ICS) flaw exploited in zero-day attacks since at least October 1st. [...]
Analysis Summary
# Vulnerability: Ivanti Connect Secure Authentication Bypass and RCE
## CVE Details
- **CVE ID:** CVE-2026-104935
- **CVSS Score:** Not explicitly listed in the text, but categorized as **High** severity.
- **CWE:** Authentication Bypass / Remote Code Execution (RCE)
## Affected Systems
- **Products:** Ivanti Connect Secure (ICS)
- **Versions:** Versions prior to the released patches (22.8R2.5, 25.1.3.0, 25.1.3.1, and 25.1.1.2).
- **Configurations:** Internet-exposed ICS hosts; approximately 5,600 identified globally.
## Vulnerability Description
CVE-2026-104935 is an authentication bypass vulnerability that allows a remote, unauthenticated threat actor to execute arbitrary commands on the targeted system. According to Volexity, the flaw can be chained with other vulnerabilities (including privilege escalation) to achieve unauthenticated root-level code execution. The commands are reported to execute in-memory, potentially evading standard disk-based integrity checks.
## Exploitation
- **Status:** Exploited in the wild (Zero-day). Exploitation began as early as October 1, 2026.
- **Complexity:** Low
- **Attack Vector:** Network (Remote)
- **User Interaction:** None required.
## Impact
- **Confidentiality:** High (Targeted theft of Active Directory credentials, LAPS passwords, and BitLocker recovery keys).
- **Integrity:** High (Arbitrary command execution and root-level access).
- **Availability:** High (Potential for full system takeover or disruption).
## Remediation
### Patches
Ivanti has released the following versions to address the flaw:
- Ivanti Connect Secure 22.8R2.5
- Ivanti Connect Secure 25.1.3.0
- Ivanti Connect Secure 25.1.3.1
- Ivanti Connect Secure 25.1.1.2
### Workarounds
No specific configuration workarounds were provided in the article; immediate patching is the primary recommendation. CISA has mandated federal agencies to secure systems by Friday, October 16, 2026.
## Detection
- **Indicators of Compromise:** Evidence of post-exploitation targeting Active Directory secrets, LAPS passwords, and BitLocker keys.
- **Detection Methods:**
- **Network and Memory Forensics:** Essential for detection, as the Ivanti Integrity Checker Tool (ICT) may not identify the threat due to the exploit's in-memory execution.
- **Incident Response:** If compromised, administrators should perform a factory reset, upgrade to the latest version, restore from a clean backup, and reset all credentials/certificates.
## References
- **Vendor Advisory:** hxxps[://]hub[.]ivanti[.]com/s/article/Security-Advisory-Ivanti-Connect-Secure-CVE-2026-104935?language=en_US
- **Volexity Research:** hxxps[://]www[.]volexity[.]com/blog/2026/10/13/a-series-of-unauthenticated-events-chained-exploitation-of-ivanti-connect-secure-zero-days/
- **CISA Alert:** hxxps[://]www[.]cisa[.]gov/news-events/alerts/2026/10/13/cisa-urges-patching-newly-exploited-vulnerability-ivanti-connect-secure
- **Shadowserver Statistics:** hxxps[://]dashboard[.]shadowserver[.]org/statistics/iot-devices/time-series/?date_range=7&vendor=pulse+secure&type=vpn&model=pulse+connect+secure+vpn&group_by=geo&stacking=stacked