Unauthenticated authentication bypass to root command execution in Ivanti Connect Secure (CVE-2026-104935)
Ivanti published the advisory and CISA added the CVE to KEV on 2026-10-13 with a 2026-10-16 remediation deadline after Volexity reported in-the-wild chained exploitation (first signs seen from October 1), so a team that leaves an internet-facing Connect Secure gateway on an affected build is exposing it to unauthenticated command execution and credential theft.
An authentication-bypass-by-spoofing flaw in Ivanti Connect Secure lets a remote, unauthenticated attacker execute arbitrary commands on the appliance. Volexity observed it chained with a further, still-unpatched flaw to run commands as root on fully patched VPN gateways, and CISA reports the activity being used for credential theft and data exfiltration.
Affected: Ivanti Connect Secure 25.1.0.0 through 25.1.1.1; Ivanti Connect Secure 25.1.2.0 through 25.1.2.2; Ivanti Connect Secure 22.8 (22.8R2.4 and prior)
How to Test
On each Connect Secure appliance, check the running version in the admin console and compare against the affected ranges above (25.1.1.1 and prior, 25.1.2.0–25.1.2.2, 22.8R2.4 and prior). Because exploitation is unauthenticated and was observed from at least October 1, review web and authentication logs from that date for unexpected unauthenticated requests to the appliance and for command execution or new administrative activity; Volexity's write-up contains request-level indicators you can match against logs, and a Nuclei template exists to confirm whether a host is still vulnerable. Follow CISA's Forensics Triage Requirements for any appliance that was exposed while unpatched, and treat credentials that transited the appliance as potentially stolen.
How to Patch
Upgrade to a release outside the affected ranges: 25.1.1.2 or later in the 25.1.1 line, or 25.1.3.0 or later; no fixed 22.8 build is listed, so move 22.8 appliances to a fixed 25.1 release. Note that reports state the third flaw in the observed chain has no fix yet, so apply any additional mitigations in Ivanti's advisory and keep the appliance under close monitoring after upgrading.