Key points
- CVE-2026-104935 allows unauthenticated remote code execution on Ivanti Connect Secure versions 22.8R2.4 and earlier, 25.1.2.2 and earlier, and 25.1.1.1 and earlier.
- Threat actor UTA0576 chains this flaw with two others to gain root access and steal Active Directory secrets, including LAPS passwords and BitLocker keys.
- Ivanti has patched the initial bypass and RCE, but a third privilege-escalation flaw remains under development with no confirmed fix yet.
Ivanti Connect Secure administrators must apply updates immediately to address CVE-2026-104935, a high-severity authentication bypass. The vendor released fixed versions 22.8R2.5, 25.1.3.0, 25.1.3.1, and 25.1.1.2 on Tuesday. This vulnerability affects older releases in the 22.8, 25.1.2, and 25.1.1 series. Remote attackers can exploit this flaw without user interaction to run commands on the gateway.
In plain English
This security gap lets outsiders bypass login screens and control the device. According to Volexity, the threat group UTA0576 uses this entry point alongside two other unknown flaws. They achieve full root access on systems that were previously patched against known issues. The attackers then search for sensitive data like domain credentials and encryption keys. They do not install permanent malware, making detection harder.
The background
Volexity reported that UTA0576 has been chaining these exploits since at least October 3. The group targets fully patched appliances running version 22.8R2.4. Defused confirmed seeing exploitation of CVE-2026-104935 starting October 1. Shadowserver tracks over 5,600 Ivanti Connect Secure instances exposed on the internet. It is unclear how many of these are vulnerable or already secured against these specific attacks.
What changes now
Ivanti has addressed the authentication bypass and remote code execution components of the chain. However, the privilege-escalation vulnerability remains unfixed. The vendor stated it is working on a solution for that third flaw. Until then, organizations face the risk of attackers gaining elevated privileges even after patching the initial entry point. Monitoring for unusual activity is critical.
Who needs to act first
Teams should prioritize updating internet-facing gateways first to reduce immediate exposure. Verify that all appliances run the latest patched versions before applying changes to internal-only systems. Create backups of current configurations to allow quick rollback if issues arise. Test updates in a non-production environment to ensure compatibility with existing network rules. Monitor logs for signs of unauthorized access or tampering during the transition period.
What to do and how to stay safe: Ivanti
- Verify current Ivanti Connect Secure versions against the affected list and apply available patches immediately.
- Monitor network traffic for unusual outbound connections or repeated authentication failures from gateway appliances.
- Review system logs for signs of tampering, as attackers may delete entries to hide their activity.
- Isolate compromised devices from the network until a full forensic analysis is complete.
Step-by-step guide: Emergency Patching: How to Fix Critical Flaws Without Breaking Systems
General security guidance from the Patch Review newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Which Ivanti Connect Secure versions are affected by CVE-2026-104935?
Versions 22.8R2.4 and earlier, 25.1.2.2 and earlier, and 25.1.1.1 and earlier are vulnerable.
Is there a fix for all three flaws in the attack chain?
Ivanti has patched the initial bypass and RCE, but the third privilege-escalation flaw remains under development.
What data are attackers stealing in these attacks?
UTA0576 targets Active Directory credentials, LAPS passwords, BitLocker recovery keys, and other directory information.
