Federal officials are calling for emergency patching of an Ivanti Connect Secure authentication bypass under active zero-day exploitation. Tracked as CVE-2026-104935, the flaw permits unauthenticated remote command execution and has been abused since at least October 1st, with credential theft observed. Fixed builds are available and CISA has set a Friday deadline for federal agencies.

Flaw and affected builds

The issue is described as a high-severity authentication bypass that allows remote actors without privileges to run arbitrary commands against targeted ICS systems in low-complexity attacks that need no user interaction.

According to NVD, authentication bypass by spoofing in ICS before version 25.1.3.0 allows a remote unauthenticated attacker to execute arbitrary commands. That description notes this does not impact ICS version 22.7R2.14 or prior. See NVD detail for CVE-2026-104935.

Ivanti released ICS versions 22.8R2.5, 25.1.3.0, 25.1.3.1, and 25.1.1.2 on Tuesday and told customers to act without delay due to limited exploitation in the wild.

How the attack works

Volexity attributes ongoing activity to an unknown actor it tracks as UTA0576, which has chained this issue with two other flaws in attacks since at least October 3rd.

The chain combines an authentication bypass, a remote code execution (RCE), and a privilege escalation vulnerability to achieve unauthenticated root-level code execution. Volexity tracks both the RCE and authentication bypass elements under CVE-2026-104935.

Post-compromise activity observed by Volexity focused on Active Directory credentials and secrets, including Local Administrator Password Solution (LAPS) passwords and BitLocker recovery keys.

Threat intel firm Defused separately corroborated in-the-wild abuse, stating it first saw evidence targeting CVE-2026-104935 on October 1st. Shadowserver now tracks over 5,600 Internet-exposed hosts with ICS fingerprints, with no public breakdown of how many remain unpatched or how many are honeypots.

A public proof-of-concept is listed at Ivanti Connect Secure RCE PoC - CVE-2026-104935, described as unauthenticated remote code execution via authentication bypass by spoofing (CWE-290) leading to remote command execution with root privileges. An index entry is also available at Exploit-Index entry for CVE-2026-104935, which records the CISA KEV addition on 2026-10-13.

Technical background

This section covers the vulnerability class in general terms and does not describe incident-specific exploit details.

CWE-290 authentication bypass by spoofing occurs when an application trusts a client-supplied identity signal, such as a header, parameter, or connection attribute, without adequate verification. An unauthenticated remote caller can then reach privileged endpoints or functions intended for logged-in users, which can lead to command execution if those functions pass input to the OS.

Generic illustration only:


# Generic example - not specific to CVE-2026-104935
curl -k -i https://example-ics-host/
# Check vendor version / patch level and review access logs for unauthenticated hits to admin paths

Detection and mitigation

On Tuesday, CISA added CVE-2026-104935 to its catalog of actively exploited flaws and ordered federal agencies to remediate by Friday under its June Binding Operational Directive 26-04. See BOD 26-04 implementation guidance and CISA alert on Ivanti Connect Secure.

Although BOD 26-04 covers only Federal Civilian Executive Branch (FCEB) agencies, CISA urged all defenders to update affected Ivanti Connect Secure appliances immediately and hunt for compromise. The agency said actors are using the zero-day for remote unauthenticated command execution, credential theft, and data exfiltration, and warned that network and memory forensics are needed because Ivanti's Integrity Checker Tool may miss activity when commands run only in memory.

For appliances found compromised, CISA recommends:

  • Create a backup of the appliance configuration.
  • Perform a factory reset and upgrade to the latest version; for cloud and virtual systems, rebuild the virtual instance and upgrade to the latest version.
  • Restore the configuration from the backup.
  • Reset passwords for all accounts, including domain, administrator, and local accounts. Revoke and reissue stored certificates; reset stored API keys and license server credentials.

Prior Ivanti exploitation

Ivanti has previously fixed other Connect Secure zero-days seen in attacks, including authentication bypass CVE-2023-46805 and command injection CVE-2024-21887 in early January 2024, and server-side request forgery CVE-2024-21893 two weeks later.

More recently it patched RCE CVE-2025-0282 in January 2025 and another RCE CVE-2025-22457 exploited by China-linked spies since at least mid-March 2025. CISA has listed 36 Ivanti vulnerabilities as actively exploited since November 2021, with 12 also abused in ransomware attacks. See the CISA KEV catalog filtered for Ivanti.