--- title: "CVE-2026-104935: Ivanti Connect Secure Zero-Day Exploited — Patch, Hunt, and Reduce VPN Risk" description: CVE-2026-104935 and two chained Ivanti Connect Secure zero-days are exploited and on CISA KEV. See the fixed builds, how to hunt, and how to cut VPN risk. image: https://blog.openvpn.net/hubfs/cve-2026-104935-ivanti-header-featured.png --- - [Blog](https://blog.openvpn.net) - [Cybersecurity](https://blog.openvpn.net/tag/cybersecurity) # CVE-2026-104935: Ivanti Connect Secure Zero-Day Exploited — Patch, Hunt, and Reduce VPN Risk Nov 2, 2026 • 7 min read ![Illustration of a compromised primary VPN appliance with a broken link beside an independent standby appliance keeping an office connected](https://blog.openvpn.net/hubfs/cve-2026-104935-ivanti-header-featured.png) Share - - - - By Adam Bullock ## An Ivanti Connect Secure zero-day chain is being exploited for root access, so upgrade to the latest fixed build even if you patched in October, hunt for compromise, and stop relying on a single VPN appliance. *Last updated: November 2, 2026. Updated with Ivanti's October 29 fixes for the two additional chained flaws (CVE-2026-111357 and CVE-2026-118527) and CISA's October 30 KEV additions.* Ivanti Connect Secure is under active attack again. **CVE-2026-104935**, an authentication bypass exploited as a zero-day, was chained with two more flaws to gain root on patched appliances, and all three are now on CISA's Known Exploited Vulnerabilities catalog. If you applied the October fix, you need to upgrade again — here's who's affected, which builds close the full chain, and how to stop a single VPN box from being a single point of failure. ## What is CVE-2026-104935 in Ivanti Connect Secure? CVE-2026-104935 is an **authentication bypass by spoofing** in Ivanti Connect Secure, the company's SSL VPN remote-access gateway. It carries a CVSSv3 score of **8.6 (High)** and allows a remote, unauthenticated attacker to run arbitrary commands on the appliance — no valid account required. Ivanti published its advisory on **October 13, 2026**, stating the flaw had already been exploited in the wild as a zero-day against a limited number of customers before disclosure. CISA added CVE-2026-104935 to its KEV catalog the same day, with an October 16 remediation deadline for federal agencies. ## The full exploit chain: two more zero-days, now patched Researchers at Volexity reported that an activity cluster tracked as **UTA0576** chained CVE-2026-104935 with two additional flaws to achieve unauthenticated **root-level code execution**, starting as early as October 3, 2026. Observed post-exploitation activity included credential theft and Active Directory queries for Windows LAPS passwords and BitLocker recovery keys. At first disclosure, part of that chain was still unpatched. On **October 29, 2026**, Ivanti released fixes for the remaining two flaws and said the latest release addresses all vulnerabilities that were chained and exploited in the wild: - **CVE-2026-111357** — missing authentication for a critical function, enabling privilege escalation to root. Ivanti rates it **8.8 (High)**; the CVE record scores it 7.0. - **CVE-2026-118527** — predictable identifiers that let an authenticated attacker upload files to a known path. CVSS **4.3 (Medium)**. CISA added both to the KEV catalog on **October 30, 2026**, with federal deadlines of November 2 (CVE-2026-111357) and November 13 (CVE-2026-118527). The key point for admins: **the October builds 25.1.1.2 and 22.8R2.5 fixed CVE-2026-104935 but do not fix the two newer flaws.** ## Who is affected by this Ivanti Connect Secure vulnerability? Use the table below to find the build that closes the full chain for your branch: | Branch | Affected versions | Upgrade to | | --- | --- | --- | | 25.1.1.x | 25.1.1.2 and prior | 25.1.1.3 | | 25.1.2.x | 25.1.2.2 and prior (CVE-2026-104935) | 25.1.3.0 / 25.1.3.1 — confirm against Ivanti's advisory | | 22.8.x | 22.8R2.5 and prior | 22.8R2.6 (Ivanti recommends migrating to 25.1.1.3 or later) | Ivanti lists 25.1.3.0 and later on ISA4500, ISA6500 and ISA8500 appliances as unaffected. Check each appliance's build number directly rather than relying on a scanner, and treat any internet-exposed appliance that ran an affected build in October as potentially compromised. ## How to respond to the Ivanti Connect Secure exploit chain today 1. **Upgrade to the latest fixed build — even if you already patched in October.** 25.1.1.2 and 22.8R2.5 remain exposed to CVE-2026-111357 and CVE-2026-118527. Federal agencies were due to remediate CVE-2026-111357 by November 2. 2. **Preserve evidence first.** Where feasible, capture memory and logs before rebooting, upgrading or rebuilding an appliance that was exposed during October. 3. **Hunt for compromise — don't rely on a clean integrity check.** Volexity reports that Ivanti's Integrity Checker Tool does not detect the observed activity, so a clean result does not rule out compromise. Review logs for anomalous authentication and command execution, unusual volumes of requests to `welcome.cgi`, unexpected files in `/tmp/`, abnormal outbound traffic, and new or modified admin accounts. 4. **Reduce exposure.** Restrict management-interface access, and limit who can reach the appliance from the internet where your deployment allows. 5. **Rotate secrets** for any appliance you cannot prove was clean — credentials, session material and certificates, plus the appliance's Active Directory service account. Given the observed targeting, consider forcing LAPS password rotation and re-keying BitLocker recovery protectors where that data may have been read. ## Why one VPN appliance is a single point of failure This chain is the latest in a long 2026 run of pre-authentication flaws in internet-facing remote-access appliances — [Cisco ASA/FTD](https://blog.openvpn.net/cve-2026-76418-cisco-asa-ftd-vpn-dos), Citrix NetScaler, F5 BIG-IP, Check Point, SonicWall and others have all shipped actively exploited zero-days this year. It also shows how a patch cycle can stretch: teams that moved fast on October 13 still had an exposed appliance until the October 29 builds. When your entire workforce reaches internal systems through one vendor's gateway, a zero-day in that gateway is a single point of failure for the whole company. That is an architecture problem, not a patching problem. Two moves reduce the blast radius: - **Keep an independent, vendor-diverse standby.** A second remote-access path built on a different codebase means a zero-day in your primary appliance does not take remote work offline while you patch, investigate and rebuild. [OpenVPN Access Server](https://openvpn.net/access-server/) is a [self-hosted secure remote access VPN](https://openvpn.net/use-cases/secure-remote-access/) you run on infrastructure you control — a practical **Ivanti alternative** or warm standby that is not exposed to the same advisory. Pair it with [VPN server clustering for high availability](https://openvpn.net/access-server/features/server-clustering-feature/) so the standby isn't a single point of failure either. - **Move toward least-privilege access.** A flat VPN that drops a user onto the network means one bypassed gateway exposes everything behind it — including directory services, as this campaign's LAPS and BitLocker queries show. [CloudConnexa](https://openvpn.net/cloud-vpn/) delivers [cloud-delivered zero trust network access (ZTNA)](https://openvpn.net/use-cases/zero-trust-network-access/), so each identity reaches only the specific applications it is entitled to, and a compromised session cannot pivot freely. This is not a claim that OpenVPN cannot have vulnerabilities — every vendor can. The point is **vendor diversity and least privilege**: do not let one appliance, from any single vendor, be the one thing between attackers and your network. ## Frequently asked questions ### Is CVE-2026-104935 being actively exploited? Yes. Ivanti and CISA both confirm exploitation in the wild. CVE-2026-104935 was added to CISA's KEV catalog on October 13, 2026, and the two flaws chained with it, CVE-2026-111357 and CVE-2026-118527, were added on October 30, 2026. Exploitation began before public disclosure. ### What is the CVSS score of CVE-2026-104935? It is rated CVSSv3 8.6 (High). It is an authentication bypass by spoofing that enables unauthenticated command execution on Ivanti Connect Secure. The chained flaws are rated 8.8 (CVE-2026-111357, per Ivanti) and 4.3 (CVE-2026-118527). ### Which Ivanti Connect Secure versions fix the full exploit chain? Ivanti's October 29 releases, 25.1.1.3 and 22.8R2.6, fix all three chained flaws. The October 13 builds, 25.1.1.2 and 22.8R2.5, fix only CVE-2026-104935, so appliances on those builds need to upgrade again. Ivanti recommends that 22.8.x customers migrate to 25.1.1.3 or later. ### Is patching enough? No. Because exploitation occurred as a zero-day, a patched appliance may already be compromised, and Ivanti's Integrity Checker Tool reportedly does not detect this activity. Preserve evidence, hunt for signs of intrusion, and rotate secrets on any device you cannot confirm was clean. ### What is a safer long-term alternative to a single VPN appliance? Run an independent, vendor-diverse remote-access path as a standby and move toward least-privilege ZTNA so a single gateway flaw cannot expose the whole network. OpenVPN Access Server and CloudConnexa are two options for that model. ### Need a remote-access path that doesn't share a single vendor's code? Try the self-hosted Access Server solution or managed CloudConnexa service for free — no credit card required. [See Which One is Right for You](https://openvpn.net/product-comparison/) ![Adam Bullock](https://blog.openvpn.net/hs-fs/hubfs/adamheadshot.jpg?width=300&height=300&name=adamheadshot.jpg) [Adam Bullock](https://blog.openvpn.net/author/adam-bullock) Adam has loved tech since the days of the dial-up modem. Read his perspective on the OpenVPN blog. ## Related posts from OpenVPN ### Subscribe for Blog Updates ```json { "@context" : "https://schema.org", "@type" : "BlogPosting", "author" : { "@type" : "Person", "name" : "Adam Bullock", "url" : "https://blog.openvpn.net/author/adam-bullock" }, "dateModified" : "2026-11-02T18:25:49.732Z", "datePublished" : "2026-11-02T18:25:49.000Z", "headline" : "CVE-2026-104935: Ivanti Connect Secure Zero-Day Exploited — Patch, Hunt, and Reduce VPN Risk", "image" : [ "https://blog.openvpn.net/hubfs/cve-2026-104935-ivanti-header-featured.png" ], "mainEntityOfPage" : { "@id" : "https://blog.openvpn.net/cve-2026-104935-ivanti-connect-secure-vulnerability", "@type" : "WebPage" }, "publisher" : { "@type" : "Organization", "logo" : { "@type" : "ImageObject", "url" : "https://blog.openvpn.net/hubfs/Dark=True%20Medium.png" }, "name" : "OpenVPN" } } ``` ```json { "@context" : "https://schema.org", "@type" : "FAQPage", "mainEntity" : [ { "@type" : "Question", "acceptedAnswer" : { "@type" : "Answer", "text" : "Yes. Ivanti and CISA both confirm exploitation in the wild. CVE-2026-104935 was added to CISA's KEV catalog on October 13, 2026, and the two flaws chained with it, CVE-2026-111357 and CVE-2026-118527, were added on October 30, 2026. Exploitation began before public disclosure." }, "name" : "Is CVE-2026-104935 being actively exploited?" }, { "@type" : "Question", "acceptedAnswer" : { "@type" : "Answer", "text" : "It is rated CVSSv3 8.6 (High). It is an authentication bypass by spoofing that enables unauthenticated command execution on Ivanti Connect Secure. The chained flaws are rated 8.8 (CVE-2026-111357, per Ivanti) and 4.3 (CVE-2026-118527)." }, "name" : "What is the CVSS score of CVE-2026-104935?" }, { "@type" : "Question", "acceptedAnswer" : { "@type" : "Answer", "text" : "Ivanti's October 29 releases, 25.1.1.3 and 22.8R2.6, fix all three chained flaws. The October 13 builds, 25.1.1.2 and 22.8R2.5, fix only CVE-2026-104935, so appliances on those builds need to upgrade again. Ivanti recommends that 22.8.x customers migrate to 25.1.1.3 or later." }, "name" : "Which Ivanti Connect Secure versions fix the full exploit chain?" }, { "@type" : "Question", "acceptedAnswer" : { "@type" : "Answer", "text" : "No. Because exploitation occurred as a zero-day, a patched appliance may already be compromised, and Ivanti's Integrity Checker Tool reportedly does not detect this activity. Preserve evidence, hunt for signs of intrusion, and rotate secrets on any device you cannot confirm was clean." }, "name" : "Is patching enough?" }, { "@type" : "Question", "acceptedAnswer" : { "@type" : "Answer", "text" : "Run an independent, vendor-diverse remote-access path as a standby and move toward least-privilege ZTNA so a single gateway flaw cannot expose the whole network. OpenVPN Access Server and CloudConnexa are two options for that model." }, "name" : "What is a safer long-term alternative to a single VPN appliance?" } ] } ```