DaystoPatch

IvantiExploited incident

Ivanti Connect Secure zero-day exploit chain (auth bypass + RCE, root privilege escalation)

CVE-2026-104935, CVE-2026-111357High, CVSS 8.6In CISA's Known Exploited Vulnerabilities catalog since 13 Oct 2026

  • Exploited after a fix existed
Partly fixedExploited. Not yet fixed for every supported version.

Open for

Counting from the first public report, 13 Oct 2026, 14:33 UTC. Ivanti disclosed it. Some versions had a fix when the bug went public. Not every supported version has one yet.

Embed this live clock

Response

Silence
0h
First public report to first vendor statement
Exposure
same day
First public report to first fix
Follow-through
ongoing
First public report to a fix for every supported version
  • Vendor silent
  • Vendor statement, no fix
  • Fixed for some versions
  • Open, no fix
  • Open, partly fixed
  • Fixed when disclosed
  • Date only, no time of day

Timeline and evidence

Open a moment to see its source and archived quote.

  1. First public report

    Ivanti security-advisory blog RSS, item 'October 2026 Security Update'CuratedQuote verified

    To that end, today we are disclosing a vulnerability in limited versions of Ivanti Connect Secure. At the time of disclosure, Ivanti is aware of limited exploitation in the wild.

    Time is this item's RSS pubDate 'Tue, 13 Oct 2026 14:33:02 Z' in the same feed. The rendered post (https://www.ivanti.com/blog/october-2026-security-update) shows only 'Last updated: October 13, 2026'. No public report of the exploitation before Ivanti's and Volexity's same-day disclosures was found; Defused later said it saw exploitation from 2026-10-01 and Volexity from 2026-10-03, but those are observation dates, not public signals.

    Recorded time
    Precision
    To the minute
    Origin
    Curated. Found by a researcher, with a verbatim quote and link.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:cb2b41e6a67111c7…
    Used in metrics
    Yes
    Dispute this timestamp
    8 more sources for this moment
    Bluesky postClaimedQuote not checked yet9 Oct 2026, 11:44 UTC

    CVE-2026-104935 - Confirmed Exploitation

    Earliest third-party post we hold.

    Source
    Bluesky post social
    Recorded time
    Precision
    To the minute
    Origin
    Claimed. The date the source gives.
    Quote check
    Not checked yet
    Snapshot
    No archived snapshot
    Used in metrics
    No, kept for the record
    Dispute this timestamp
    CISA KEV (CVE-2026-104935)ClaimedQuote verified13 Oct 2026

    Ivanti Connect Secure Authentication Bypass by Spoofing Vulnerability

    Added to CISA's KEV catalog on 2026-10-13.

    Recorded time
    Precision
    Date only (no time of day is shown)
    Origin
    Claimed. The date the source gives.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:ef8fffede5c47200…
    Used in metrics
    No, kept for the record
    Dispute this timestamp
    Volexity blogCuratedQuote verified13 Oct 2026

    Volexity has identified active in-the-wild exploitation of a vulnerability chain allowing unauthenticated remote code execution in Ivanti Connect Secure VPN devices.

    Post dated October 13, 2026 (no time shown). Published as part of coordinated disclosure with Ivanti on the same day.

    Source
    Volexity blog research
    Recorded time
    Precision
    Date only (no time of day is shown)
    Origin
    Curated. Found by a researcher, with a verbatim quote and link.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:ce656f8c46fe256b…
    Used in metrics
    No, kept for the record
    Dispute this timestamp
    Ivanti blog postClaimedQuote verified13 Oct 2026, 14:33 UTC

    October 2026 Security Update

    The vendor's own disclosure.

    Source
    Ivanti blog post vendor blog
    Recorded time
    Precision
    To the minute
    Origin
    Claimed. The date the source gives.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:cb2b41e6a67111c7…
    Used in metrics
    No, kept for the record
    Dispute this timestamp
    Mastodon postClaimedQuote not checked yet13 Oct 2026, 14:47 UTC

    Ivanti Connect Secure vulnerability CVE-2026-104935 is exploited in the wild, letting unauthenticated attackers run commands. Update to 25.1.1.2 now. # Ivanti # ConnectSecure # CVE2026104935 # ExploitedInTheWild

    Earliest third-party post we hold.

    Source
    Mastodon post social
    Recorded time
    Precision
    To the minute
    Origin
    Claimed. The date the source gives.
    Quote check
    Not checked yet
    Snapshot
    No archived snapshot
    Used in metrics
    No, kept for the record
    Dispute this timestamp
    CVE.org record CVE-2026-104935ClaimedQuote verified13 Oct 2026, 15:31 UTC

    Authentication bypass by spoofing in ICS before version 25.1.3.0 allows a remote unauthenticated attacker to execute arbitrary commands. This does not impact ICS version 22.7R2.14 or prior.

    CVE record published.

    Recorded time
    Precision
    To the minute
    Origin
    Claimed. The date the source gives.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:3ea3901cd1371613…
    Used in metrics
    No, kept for the record
    Dispute this timestamp
    Research: volexityClaimedQuote verified13 Oct 2026, 15:32 UTC

    to achieve unauthenticated root-level code execution. The RCE and authentication bypass vulnerabilities are tracked under CVE-2026-104935. Volexity identified a range of post-exploitation actions undertaken by the threat actor that targeted Active Directory credentials and secrets, including Local

    Earliest mention we hold (a vetted outlet).

    Source
    Research: volexity research
    Recorded time
    Precision
    To the minute
    Origin
    Claimed. The date the source gives.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:67e4b8f33d82c4b8…
    Used in metrics
    No, kept for the record
    Dispute this timestamp
    News: darkreadingClaimedQuote verified14 Oct 2026, 21:20 UTC

    CVE-2026-104935, a high-severity authentication bypass + RCE vulnerability, was only partially discovered and patched in July, leaving an opening for threat actors to capitalize

    Earliest mention we hold (a vetted outlet).

    Recorded time
    Precision
    To the minute
    Origin
    Claimed. The date the source gives.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:f23c3be0afb8403e…
    Used in metrics
    No, kept for the record
    Dispute this timestamp

  2. Vendor statement

    at disclosure

    Ivanti blog postClaimedQuote verified

    October 2026 Security Update

    Source
    Ivanti blog post vendor blog
    Recorded time
    Precision
    To the minute
    Origin
    Claimed. The date the source gives.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:cb2b41e6a67111c7…
    Used in metrics
    Yes
    Dispute this timestamp
    2 more sources for this moment
    Ivanti security-advisory blog RSS, item 'October 2026 Security Update'CuratedQuote verified13 Oct 2026, 14:33 UTC

    Tue, 13 Oct 2026 14:33:02 Z

    pubDate of the 'October 2026 Security Update' item, which links the Connect Secure CVE-2026-104935 advisory. The advisory itself (hub/forums.ivanti.com) is JavaScript-only and has no Wayback capture with content, so its own publication time could not be read.

    Recorded time
    Precision
    To the minute
    Origin
    Curated. Found by a researcher, with a verbatim quote and link.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:cb2b41e6a67111c7…
    Used in metrics
    No, kept for the record
    Dispute this timestamp
    CVE record CVE-2026-104935 (CNA: Ivanti)CuratedQuote verified13 Oct 2026, 15:31 UTC

    "datePublished":"2026-10-13T15:31:07.757Z"

    Recorded time
    Precision
    To the minute
    Origin
    Curated. Found by a researcher, with a verbatim quote and link.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:3ea3901cd1371613…
    Used in metrics
    No, kept for the record
    Dispute this timestamp

  3. First workaround

    No official mitigation found yet.

  4. First fix

    date onlysame day

    Rapid7 Emergent Threat Response (quoting Ivanti)CuratedQuote verified

    a portion of the vulnerability was initially discovered through its product security program and patched in the July 2026 release of 25.1.3.0.

    Upper bound: the source gives only the month ('July 2026'), so the last day of July is used; 25.1.3.0's release-notes revision history also reads '3.0 July 2026 Updated what's new, VM support, and Fixed Issues for 25.1.3.0' (help.ivanti.com). 25.1.3.0 is listed as a resolved version in Ivanti's advisory, so it is a complete fix for the 25.1.3 line (R1). Rapid7 continues: 'Exploitation occurred while Ivanti was working to backport the fix to the remaining supported versions.'

    Recorded time
    Precision
    Date only (no time of day is shown)
    Origin
    Curated. Found by a researcher, with a verbatim quote and link.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:abd0fcce71e8822a…
    Used in metrics
    Yes
    Dispute this timestamp
    2 more sources for this moment
    Volexity blogCuratedQuote verified13 Oct 2026

    Ivanti is tracking both the RCE and authentication bypass components of this chain under CVE-2026-104935. This vulnerability was fixed in patches released on October 13, 2026.

    Source
    Volexity blog research
    Recorded time
    Precision
    Date only (no time of day is shown)
    Origin
    Curated. Found by a researcher, with a verbatim quote and link.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:ce656f8c46fe256b…
    Used in metrics
    No, kept for the record
    Dispute this timestamp
    Ivanti security-advisory blog RSS, item 'October 2026 Security Update'CuratedQuote verified13 Oct 2026, 14:33 UTC

    Customers should review the security advisory, upgrade to the fixed version as soon as possible, and run the Integrity Checker Tool regularly.

    Time is the item's RSS pubDate. Fixed builds per the advisory as reported by Rapid7/BleepingComputer: 22.8R2.5, 25.1.1.2, 25.1.3.0 and 25.1.3.1. Ivanti also said a portion of the bug was fixed earlier in 25.1.3.0 (July 2026); the exact July release date could not be evidenced, so no earlier candidate is recorded.

    Recorded time
    Precision
    To the minute
    Origin
    Curated. Found by a researcher, with a verbatim quote and link.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:cb2b41e6a67111c7…
    Used in metrics
    No, kept for the record
    Dispute this timestamp

  5. Fixed for all versions

    No evidence yet of fixed releases for every supported branch.

Send this to your boss

Ivanti Connect Secure VPN zero-day chain exploited; one of three flaws unfixed

Attackers chained three Ivanti Connect Secure flaws to run commands as root without logging in; part of the bug was fixed in 25.1.3.0 in July 2026, the other code lines were fixed on 13 October 2026, and a privilege-escalation fix is still pending.

In plain words

Attackers have been breaking into Ivanti Connect Secure VPN appliances using a set of three previously unknown flaws, and they took stored passwords from at least one victim. Ivanti released updates on 13 October 2026 that close the way in; a fix for the third flaw, which only matters once an attacker is already on the device, is still coming. If we use Ivanti Connect Secure, we need to install the update now and check the appliance for signs of break-in, because the vendor's own checking tool can miss this attack. Ivanti's 25.1.3.0 release from July 2026 already contained the fix for its code line.

What happened and who is affected

What happened

Volexity found an attacker it calls UTA0576 breaking into a fully patched Ivanti Connect Secure 22.8R2.4 VPN appliance from 3 October 2026, using an authentication bypass, a code-execution flaw and a privilege-escalation flaw together. Ivanti had already fixed part of the flaw in the 25.1.3.0 release in July 2026 and was backporting the fix when the attacks happened. On 13 October 2026 Ivanti disclosed CVE-2026-104935 with fixed builds for the other code lines and said it knew of limited exploitation. The privilege-escalation flaw (CVE-2026-111357) has no fix yet.

Who is affected

Ivanti Connect Secure 22.8R2.4 and earlier in the 22.8 line, 25.1.1.1 and earlier, and 25.1.2.2 and earlier. Versions 22.7R2.14 and earlier are not affected by CVE-2026-104935. Fixed builds: 22.8R2.5, 25.1.1.2, 25.1.3.0 and 25.1.3.1.

CVE-2026-104935, CVE-2026-111357. Reviewed 23 Oct 2026. https://daystopatch.com/incidents/ivanti-cve-2026-104935/

Affected products

  • Ivanti Connect Secure (ICS) 22.8R2.4 and earlier in the 22.8 line
  • Ivanti Connect Secure 25.1.1.1 and earlier
  • Ivanti Connect Secure 25.1.2.2 and earlier
How we built this timeline

Grouping: CVE-2026-111357 (privilege escalation via dsinvoked/DSCache, CVE assigned by MITRE on 15 Oct 2026, not in KEV) was exploited in the same Volexity-reported chain, so it is grouped here. Status 'partial': CVE-2026-104935 has fixed builds for every listed code line from 13 Oct 2026, but no fix for CVE-2026-111357 was found as of 22 Oct 2026 (Volexity: 'Ivanti is working on a fix for the privilege escalation vulnerability, and it will be included in a future release in the coming weeks.').

Fixed for all versions is deliberately omitted until that fix ships. Ivanti said a portion of CVE-2026-104935 was fixed in the July 2026 25.1.3.0 release (per The Register and Rapid7 quoting the advisory); exact date not evidenced.

The Ivanti advisory page itself is JavaScript-only; fixed versions are taken from Rapid7 and BleepingComputer reproductions of it and from the CVE record. Exploitation start: Volexity says 3 Oct 2026, Defused (via BleepingComputer) says 1 Oct 2026; neither was public before 13 Oct 2026.

Ivanti published no interim workaround (The Hacker News: neither Volexity nor Ivanti names a temporary workaround). Severity: Ivanti CVSS 3.1 8.6 (HIGH);

CVE-2026-111357 is CVSS 7.0. Correction 23 Oct 2026: exploited before a fix changed from true to false under rule R4, because a complete fixed release for one line (25.1.3.0, July 2026) was public before the earliest exploitation evidence (1 Oct 2026/03, published 13 Oct 2026); the other lines (22.8, 25.1.1) were exploited while the backport was in progress.

The July 2026 25.1.3.0 release is now a First fix candidate (day upper bound 31 Jul 2026).

Related

No related incidents.

Ivanti report card