Ivanti Connect Secure Zero-Day Exploited, Fix By Oct 16

Ivanti has released a patch for CVE-2026-104935, an authentication bypass by spoofing (CWE-290) in Connect Secure, with confirmed active exploitation and a CISA KEV mandatory patch deadline of October 16.

If you run Ivanti Connect Secure, apply the patch now.

What the flaw is

CVE-2026-104935 is rated CVSS 8.6 (high). It lets an unauthenticated remote attacker execute arbitrary commands on a Connect Secure gateway. Ivanti published its security advisory on October 13; Rapid7 confirmed active exploitation the same day.

This CVE is part of a larger attack chain. Volexity researchers, cited by The Hacker News and SecurityWeek, documented a three-vulnerability sequence in Connect Secure that gave attackers root-level access on fully patched appliances. Ivanti has fixed two of the three; the third remains unpatched as of this writing.

BleepingComputer reports that Ivanti is urging immediate patching. Affected version details are in the vendor advisory.

What to do

Apply the patch Ivanti released October 13. Federal agencies have until October 16 under CISA’s BOD 26-04 guidance. The KEV entry also directs agencies to follow forensics triage requirements listed in the catalog.

If your product version cannot be patched, CISA’s guidance is to discontinue use.

A third zero-day in this chain remains unpatched. Watch Ivanti’s advisory channel for follow-on patches.

Prior Connect Secure zero-days

This is not the first time Ivanti Connect Secure zero-days have been chained for unauthenticated access. See our earlier coverage: Inside Ivanti Connect Secure’s Chained Zero-Days and Ivanti Patches Critical RCE in Neurons, EPMM, Sentry. For context on how CISA enforces KEV deadlines, see CISA: Five Flax Typhoon CVEs Added, Feds Have Until Oct 11.