CVE-2026-104935: Ivanti Connect Secure Authentication Bypass by Spoofing Vulnerability

Rapid7 reports that on October 13, 2026, Ivanti published a security advisory for CVE-2026-104935, a high-severity authentication bypass by spoofing (CWE-290)[2], which has a CVSSv3.0 score of 8.6 and allows a remote, unauthenticated attacker to execute arbitrary commands.[2]CISA says the flaw affects Ivanti Connect Secure versions 25.1.1.1 and prior, 25.1.2.2 and prior, and 22.8R2.4 and prior.[3] The agency says it added CVE-2026-104935 to its Known Exploited Vulnerabilities (KEV) Catalog on Oct. 13, 2026.[3]Ivanti told customers it was aware of "limited exploitation in the wild"[1], BleepingComputer reports.Volexity says that in the first week of October 2026[4] it found an unknown threat actor, UTA0576, using an exploit chain that combined an authentication bypass, a remote code execution (RCE), and a privilege escalation vulnerability to achieve unauthenticated root-level code execution.[4] According to Volexity, Ivanti is working on a fix for the privilege escalation vulnerability which will be patched in a future release.[4]BleepingComputer reports that threat intelligence firm Defused caught the first signs of CVE-2026-104935 exploitation in the wild starting October 1.[1]Volexity says the attacker targeted Active Directory credentials and secrets, including Local Administrator Password Solution (LAPS) passwords and BitLocker recovery keys.[4]CISA warns that Ivanti's Integrity Checker Tool may not detect evidence of exploitation of CVE-2026-104935 because threat actor commands execute in memory.[3]