# Ivanti Connect Secure zero-day chain (CVE-2026-104935) exploited for root · pwn.watch > Volexity observed threat actor UTA0576 chaining an Ivanti Connect Secure authentication-bypass / RCE zero-day (CVE-2026-104935) with additional flaws from about Oct 1–3 2026 to get unauthenticated root on fully patched appliances, re-exploiting in memory without planting webshells. Ivanti patched CVE-2026-104935 on Oct 13; CISA added it to KEV. One privilege-escalation piece of the chain was still being fixed at disclosure. Page: https://pwn.watch/i/ivanti-connect-secure-cve-2026-104935 · generated 2026-10-26T16:03:32.143Z ## Status - Severity: high · status: live · patch: partial - Product: Ivanti Connect Secure (ICS) - Started: 2026-10-01 - CVEs: CVE-2026-104935 - Affected: 25.1.1.1 and prior; 25.1.2.2 and prior; 22.8R2.4 and prior (22.7.x and below unaffected) - Fixed in: 25.1.1.2; 25.1.3.0 / 25.1.3.1; 22.8R2.5 ## Follow this incident - RSS (one item per update): https://pwn.watch/i/ivanti-connect-secure-cve-2026-104935/feed.xml - JSON Feed: https://pwn.watch/i/ivanti-connect-secure-cve-2026-104935/feed.json - Full data (timeline, sources, posts, agentBrief): https://pwn.watch/i/ivanti-connect-secure-cve-2026-104935.json - This file: https://pwn.watch/i/ivanti-connect-secure-cve-2026-104935/llms.txt ## Updates (newest first) - 2026-10-26: dbugs reports a dark-web seller offering a pre-auth RCE-to-root PoC for CVE-2026-104935 for $3,000 (seller claims tested on 25.1.1.1, 25.1.2.2 and 22.8R2.4; unverified). (https://dbu.gs/news/sale-of-a-poc-for-a-vulnerability-in-ivanti-connect-secure-cve-2026-104935-20261026) - 2026-10-13: Ivanti discloses and patches CVE-2026-104935; Volexity publishes. - 2026-10-13/16: CISA KEV listing; federal patching deadline reported as Oct 16. - 2026-10-03: Volexity sees UTA0576 chaining for unauth root. - 2026-10-03: Volexity: UTA0576 chains the auth bypass + RCE (CVE-2026-104935) with a still-unpatched privilege escalation for root. (https://www.volexity.com/blog/2026/10/13/a-series-of-unauthenticated-events-chained-exploitation-of-ivanti-connect-secure-zero-days/) - 2026-10-01: Defused reports first signs of exploitation. ## Fix brief # Security brief: Ivanti Connect Secure zero-day chain (CVE-2026-104935) exploited for root Source: https://pwn.watch/i/ivanti-connect-secure-cve-2026-104935 · status: live · severity: high · updated Oct 26, 2026, 12:57 UTC ## Patch status **PARTIALLY PATCHED: some fixes exist, but not every affected branch/product is covered. Check carefully and apply mitigations where no fix exists.** ## What it is Volexity observed threat actor UTA0576 chaining an Ivanti Connect Secure authentication-bypass / RCE zero-day (CVE-2026-104935) with additional flaws from about Oct 1–3 2026 to get unauthenticated root on fully patched appliances, re-exploiting in memory without planting webshells. Ivanti patched CVE-2026-104935 on Oct 13; CISA added it to KEV. One privilege-escalation piece of the chain was still being fixed at disclosure. Severity detail: High (CVSS ~8.6 reported in secondary sources); actively exploited / CISA KEV - Product: Ivanti Connect Secure (ICS) - CVE / advisory ids: CVE-2026-104935 ## Affected versions - 25.1.1.1 and prior - 25.1.2.2 and prior - 22.8R2.4 and prior (22.7.x and below unaffected) ## Check whether you're affected No generic command applies (the product is a hosted service, appliance or desktop app). Check the installed version in its admin UI / About screen and compare with the versions above. ## Fix Upgrade to one of these fixed versions (or later on the same branch): - 25.1.1.2 - 25.1.3.0 / 25.1.3.1 - 22.8R2.5 After upgrading, re-run the checks above and redeploy/restart the affected services. ## Mitigations The data marks this as partial. Until every affected component is fixed, apply the vendor mitigations from the advisories below (restrict network exposure of the affected service, disable the vulnerable feature if the advisory allows). ## Latest updates - Oct 26, 2026: dbugs reports a dark-web seller offering a pre-auth RCE-to-root PoC for CVE-2026-104935 for $3,000 (seller claims tested on 25.1.1.1, 25.1.2.2 and 22.8R2.4; unverified). - Oct 13, 2026: Ivanti discloses and patches CVE-2026-104935; Volexity publishes. - Oct 13/16, 2026: CISA KEV listing; federal patching deadline reported as Oct 16. - Oct 3, 2026: Volexity sees UTA0576 chaining for unauth root. - Oct 3, 2026: Volexity: UTA0576 chains the auth bypass + RCE (CVE-2026-104935) with a still-unpatched privilege escalation for root. - Oct 1, 2026: Defused reports first signs of exploitation. ## Advisories - [Volexity: Chained Exploitation of Ivanti Connect Secure Zero-Days](https://www.volexity.com/blog/2026/10/13/a-series-of-unauthenticated-events-chained-exploitation-of-ivanti-connect-secure-zero-days/) (Volexity) - [Ivanti October 2026 Security Update](https://www.ivanti.com/blog/october-2026-security-update) (Ivanti) - [BleepingComputer: Ivanti warns of Connect Secure zero-day](https://www.bleepingcomputer.com/news/security/ivanti-warns-of-connect-secure-zero-day-exploited-in-attacks/) (BleepingComputer) ## Write-ups & news - [Ivanti Connect Secure zero-day exploited in the wild (CVE-2026-104935)](https://www.rapid7.com/blog/post/etr-ivanti-connect-secure-zero-day-exploited-in-the-wild-cve-2026-104935/) - [Sale of a PoC for a vulnerability in Ivanti Connect Secure (CVE-2026-104935)](https://dbu.gs/news/sale-of-a-poc-for-a-vulnerability-in-ivanti-connect-secure-cve-2026-104935-20261026) ## Caveats Exact fixed version strings should be taken from Ivanti’s advisory. Volexity reported a still-unpatched privilege-escalation piece in the chain at disclosure — patchStatus partial / lifecycle live. --- Machine-readable: https://pwn.watch/i/ivanti-connect-secure-cve-2026-104935.json · all incidents: https://pwn.watch/incidents.json. Verify against the vendor advisory before changing production systems.