Full Report
The security vendor said it initially discovered a portion of the defect during internal security checks in June, but the company said it didn’t meet the threshold for an out-of-band release. The post Ivanti misses opportunity to fix vulnerability before attackers got to work and made it a zero-day appeared first on CyberScoop.
Analysis Summary
# Vulnerability: Ivanti Connect Secure Unauthenticated Remote Code Execution
## CVE Details
- **CVE ID:** CVE-2026-104935
- **CVSS Score:** High (Exact numerical score pending, described as "High-severity")
- **CWE:** Chained vulnerabilities including Authentication Bypass and Remote Code Execution (RCE).
## Affected Systems
- **Products:** Ivanti Connect Secure (ICS) VPN appliances.
- **Versions:** Specific versions not listed in the article; implies all versions prior to the October 2026 update.
- **Configurations:** Devices exposed to the network/internet.
## Vulnerability Description
CVE-2026-104935 is a high-severity defect in Ivanti Connect Secure that allows for unauthenticated remote code execution. The flaw is part of an exploit chain discovered by Volexity, which involves three distinct zero-day vulnerabilities. When chained, these flaws allow an attacker to bypass authentication, execute commands in memory, and escalate privileges. Ivanti initially discovered a portion of this defect in June 2026 but did not issue an out-of-band patch at that time.
## Exploitation
- **Status:** Exploited in the wild (Zero-day).
- **Complexity:** Medium (Requires chaining multiple vulnerabilities).
- **Attack Vector:** Network.
## Impact
- **Confidentiality:** Total (Credential theft and Active Directory metadata exfiltration observed).
- **Integrity:** Total (Log tampering and deployment of malicious tools).
- **Availability:** High (Ability to run arbitrary commands on the appliance).
## Remediation
### Patches
- Ivanti has released a security update in October 2026 that addresses the unauthenticated RCE component. Customers are urged to upgrade to the latest software version immediately via the [Ivanti Blog](https://www[.]ivanti[.]com/blog/october-2026-security-update).
### Workarounds
- No specific workarounds (like configuration changes) were provided; the primary recommendation is an immediate firmware upgrade.
## Detection
- **Indicators of Compromise:** Volexity has published IOCs related to threat actor UTA0576.
- **Detection Methods and Tools:**
- **Note:** CISA warns that the Ivanti **Integrity Checker Tool (ICT)** may **not** detect this exploitation because commands are executed in memory.
- Organizations are advised to conduct network and memory forensics to find evidence of compromise.
- Monitor for unauthorized credential dumping or Active Directory metadata extraction.
## References
- Ivanti Security Advisory: [https://hub[.]ivanti[.]com/s/article/Security-Advisory-Ivanti-Connect-Secure-CVE-2026-104935]
- Volexity Technical Analysis: [https://www[.]volexity[.]com/blog/2026/10/13/a-series-of-unauthenticated-events-chained-exploitation-of-ivanti-connect-secure-zero-days/]
- CISA Alert: [https://www[.]cisa[.]gov/news-events/alerts/2026/10/13/cisa-urges-patching-newly-exploited-vulnerability-ivanti-connect-secure]