Reported by 16 outlets

Timeline

1. original reporting

   Ivanti Connect Secure zero-day CVE-2026-104935 We are aware of exploitation in the wild affecting a limited number of customers at the time

   hub.ivanti.com · 13h ago · October 13th, 2026

   Ivanti Connect Secure zero-day CVE-2026-104935 We are aware of exploitation in the wild affecting a limited number of customers at the time

   via Mastodon https://hub.ivanti.com/s/article/Security-Advisory-Ivanti-Connect-Secure-CVE-2026-104935?language=en_US

2. update from hub.ivanti.com

   Security Advisory Ivanti Connect Secure (CVE-2026-104935) - Ivanti

   hub.ivanti.com · 1d ago · October 13th, 2026

   Ivanti's PSIRT advisory for Connect Secure CVE-2026-104935 was published on October 13, 2026, before the Canadian Centre advisory the story is built on (date per Rapid7's same-day ETR post and the NVD record; the Ivanti portal is JavaScript-rendered and was read through those sources). It maps affected lines to fixed builds: 25.1.1.1 and prior to 25.1.1.2, 25.1.2.2 and prior to 25.1.3.0 or 25.1.3.1, and 22.8R2.4 and prior to 22.8R2.5, with 22.7.x and below unaffected. Ivanti stated exploitation had occurred before disclosure affecting a limited number of customers.

3. update from securityonline.info

   Ivanti Connect Secure vulnerability CVE-2026-104935 is exploited in the wild, letting unauthenticated attackers run commands. Update to 25.1

   securityonline.info · 13h ago · October 13th, 2026

   Ivanti Connect Secure vulnerability CVE-2026-104935 is exploited in the wild, letting unauthenticated attackers run commands. Update to 25.1

   via Mastodon https://securityonline.info/ivanti-connect-secure-cve-2026-104935-exploited/?utm_source=mastodon&utm_medium=jetpack_social

4. update from techupscale.com

   🚨 BREAKING: Ivanti Connect Secure flaw CVE-2026-104935 is being actively exploited, CISA warns CVE-2026-104935 · US federal deadline October

   techupscale.com · 13h ago · October 13th, 2026

   🚨 BREAKING: Ivanti Connect Secure flaw CVE-2026-104935 is being actively exploited, CISA warns CVE-2026-104935 · US federal deadline October

   via Mastodon https://techupscale.com/ivanti-connect-secure-flaw-cve-2026-104935-is-being-actively-exploited-cisa-warns/?utm_source=mastodon&utm_medium=social&utm_campaign=auto

5. update from volexity.com

   A Series of Unauthenticated Events: Chained Exploitation of Ivanti Connect Secure Zero-Days

   volexity.com · 12h ago · October 13th, 2026

   Volexity documented in-the-wild exploitation of a three-bug chain giving unauthenticated root code execution on a fully patched Connect Secure 22.8R2.4 (Build 19097) appliance, exploited from October 3, 2026 by a previously unknown actor tracked as UTA0576. The chain combines an authentication bypass in welcome.cgi that routes requests to arbitrary CGI files via an X-DSCGI-PATH header, a file-write race in wu.cgi that lands scripts under /home/runtime/tmp/, and a privilege escalation in the dsinvoked broker's trust of DSCache configuration data. The actor dumped appliance credentials and Active Directory secrets including LAPS passwords and BitLocker recovery keys, then deleted evidence from Ivanti debug logs and Linux audit logs, with command traffic carried inside the exploit chain's own HTTPS requests.

6. update from bleepingcomputer.com

   Ivanti warns of Connect Secure zero-day exploited in attacks

   bleepingcomputer.com · 12h ago · October 13th, 2026

   Ivanti urged customers on Tuesday to immediately patch an actively exploited zero-day vulnerability in the Ivanti Connect Secure (ICS) remote access gateway. Formerly known as Pulse Connect Secure and originally Juniper Pulse, the enterprise-grade ICS SSL VPN provides remote employees, contractors, and hybrid workforces with secure access to corporate and cloud resources. Tracked as CVE-2026-104935 , this high-severity authentication bypass zero-day affects ICS versions 22.8R2.4 and earlier, 25.1.2.2 and earlier, and 25.1.1.1 and earlier. Remote threat actors without privileges can exploit CVE-2026-104935 in low-complexity attacks that don't require user interaction to execute arbitrary commands on targeted ICS appliances. We are working directly with those organizations while making information, updates and remediation available to the broader customer community. If you are running one of the impacted versions, Ivanti recommends you act immediately," Ivanti said . "Customers should review the security advisory, upgrade to the fixed version as soon as possible, and run the Integrity Checker Tool regularly." Internet threat watchdog Shadowserver now tracks over 5,500 ICS instances exposed online , but there is no information on how many are honeypots or have already been secured against ongoing attacks. Cybersecurity firm Volexity, which found and reported the flaw, revealed earlier today that a p

7. update from www.volexity.com

   @ volexity has discovered in-the-wild exploitation of a # zeroday exploit chain targeting Ivanti Connect Secure VPN appliances (CVE-2026-104

   www.volexity.com · 12h ago · October 13th, 2026

   @ volexity has discovered in-the-wild exploitation of a # zeroday exploit chain targeting Ivanti Connect Secure VPN appliances (CVE-2026-104

   via Mastodon https://www.volexity.com/blog/2026/10/13/a-series-of-unauthenticated-events-chained-exploitation-of-ivanti-connect-secure-zero-days/

8. mentioned by www.volexity.com

   Volexity has identified active in-the-wild exploitation of a vulnerability chain allowing unauthenticated remote code execution in Ivanti Co

   www.volexity.com · 12h ago · October 13th, 2026

9. update from watchtowr.com

   CVE-2026-104935: Ivanti Connect Secure Authentication Bypass by Spoofing (watchTowr intelligence note)

   watchtowr.com · 12h ago · October 13th, 2026

   watchTowr published an intelligence note on CVE-2026-104935 describing it as an authentication bypass by spoofing in Ivanti Connect Secure that lets a remote attacker run commands without logging in. The note relays the vendor's confirmation of exploitation in the wild and urges immediate updates for affected branches.

10. mentioned by www.volexity.com

    (volexity.com) Zero-Day Exploit Chain in Ivanti Connect Secure VPN Enables Unauthenticated Remote Code Execution In brief - This article des

    www.volexity.com · 12h ago · October 13th, 2026

11. mentioned by ifin.network

    An Ivanti 0-day auth bypass is being exploited in the wild with significant post-exploitation activity. https:// ifin.network/t/cve-2026-104

    ifin.network · 11h ago · October 13th, 2026

12. mentioned by www.bleepingcomputer.com

    🤖 CVE-2026-104935: authentication-bypass zero-day in Ivanti Connect Secure (ICS), exploited in the wild. Unauthenticated attackers can execu

    www.bleepingcomputer.com · 11h ago · October 13th, 2026

13. mentioned by securityonline.info

    UTA0576 chained an Ivanti Connect Secure zero-day, CVE-2026-104935, with a root exploit to steal AD credentials. Patch now and check memory.

    securityonline.info · 11h ago · October 13th, 2026

14. update from www.bleepingcomputer.com

    Ivanti itself is urging customers to patch immediately, which is merchant-speak for "we are very, very sorry about your network." Patch Ivan

    www.bleepingcomputer.com · 11h ago · October 13th, 2026

    Ivanti itself is urging customers to patch immediately, which is merchant-speak for "we are very, very sorry about your network." Patch Ivan

    via Mastodon https://www.bleepingcomputer.com/news/security/ivanti-warns-of-connect-secure-zero-day-exploited-in-attacks/

15. update from theperimetersite.com

    CISA added CVE-2026-104935 to its known exploited list this afternoon. For those managing Ivanti Connect Secure gateways, the clock is now t

    theperimetersite.com · 11h ago · October 13th, 2026

    CISA added CVE-2026-104935 to its known exploited list this afternoon. For those managing Ivanti Connect Secure gateways, the clock is now t

    via Mastodon https://theperimetersite.com/report/351

16. update from secdb.nttzen.cloud

    🚨 [CISA-2026:1013] CISA Adds One Known Exploited Vulnerability to Catalog ( https:// secdb.nttzen.cloud/security-ad visory/detail/CISA-2026:

    secdb.nttzen.cloud · 11h ago · October 13th, 2026

    🚨 [CISA-2026:1013] CISA Adds One Known Exploited Vulnerability to Catalog ( https:// secdb.nttzen.cloud/security-ad visory/detail/CISA-2026:

    via Mastodon https://secdb.nttzen.cloud/security-advisory/detail/CISA-2026:1013

17. update from rapid7.com

    Ivanti Connect Secure zero-day exploited in the wild (CVE-2026-104935)

    rapid7.com · 11h ago · October 13th, 2026

    Volexity notes that in addition to leveraging CVE-2026-104935 as a zero-day, the threat actor also leveraged an as-yet unpatched privilege escalation vulnerability which Ivanti are planning to patch at a later date. According to the vendor, a portion of the vulnerability was initially discovered through its product security program and patched in the July 2026 release of 25.1.3.0 . Exploitation occurred while Ivanti was working to backport the fix to the remaining supported versions. Ivanti Connect Secure is a popular enterprise VPN solution and naturally sits on the edge of a corporate env

18. update from rapid7.com

    Ivanti Connect Secure zero-day exploited in the wild (CVE-2026-104935) - Rapid7 Attacker Behavior Analysis

    rapid7.com · 11h ago · October 13th, 2026

    Rapid7 recommends emergency patching outside normal cycles, notes no reliable vendor IoCs at advisory time while Volexity published several, and says compromise hunting must continue even after patching.

19. mentioned by www.rapid7.com

    (rapid7.com) Critical Zero-Day Authentication Bypass in Ivanti Connect Secure Exploited in the Wild In brief - This article discusses a high

    www.rapid7.com · 10h ago · October 13th, 2026

20. mentioned by ninjasignal.ninja

    🚨 NEW on CISA KEV — exploited in the wild 🛡 Ivanti Connect Secure Ivanti Connect Secure Authentication Bypass by Spoofing Vulnerability CVE:

    ninjasignal.ninja · 9h ago · October 13th, 2026

21. update from securityweek.com

    Ivanti Zero-Day Chain Gave Attackers Root Access to Fully Patched VPN

    securityweek.com · 9h ago · October 13th, 2026

    The third vulnerability, a privilege escalation issue, remains unpatched, and the vendor plans to fix it over the coming weeks. Volexity, which found evidence of exploitation starting on October 3, says UTA0576 focused primarily on credential theft, data exfiltration, network reconnaissance, and log tampering. The attackers stole domain credentials stored on the appliance and exfiltrated limited Active Directory metadata. They also ran password-sprayi

22. update from malware.news

    Ivanti security advisory (AV26-1035)

    malware.news · 8h ago · October 13th, 2026

    Serial number: AV26-1035 Date: October 13, 2026 As of October 13, 2026, Ivanti is affected by vulnerabilities in the following products: Ivanti Connect Secure Version 25.1.1.1 and prior Version 25.2.2 and prior Version 22.8R2.4 and prior Ivanti Neurons Patch for Intune Versions prior to September 16, 2026 Ivanti Xtraction Version 2026.2.1 and prior On October 13, 2026, Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2026-CVE-2026-104935 to their Known Exploited Vulnerabilities (KEV) Database. The Cyber Centre encourages users and administrators to review the provided web links and apply any necessary updates as they become available.

23. update from cyberscoop.com

    Ivanti misses opportunity to fix vulnerability before attackers got to work and made it a zero-day

    cyberscoop.com · 5h ago · October 13th, 2026

    “Because the issue was discovered internally, was not being actively exploited, and did not meet the threshold for an out-of-band release, a fix was scheduled for inclusion in our normal product release cycle,” an Ivanti spokesperson wrote in response to questions. “Successful exploitation requires chaining multiple vulnerabilities and Ivanti has fully addressed the unauthenticated remote code execution component of that chain, eliminating the primary exploitation path,” the spokesperson added. “We are also developing additional updates to address the remaining vulnerability and further strengthen product security.” The full scope of compromi

24. update from cyberscoop.com

    Ivanti misses opportunity to fix vulnerability before attackers got to work and made it a zero-day

    cyberscoop.com · 5h ago · October 13th, 2026

    submitted by /u/drewchainzz [link] [comments]

    via reddit r/cybersecurity: Ivanti misses opportunity to fix vulnerability before attackers got to work and made it a zero-day

25. mentioned by threataft.com

    🚨 Ivanti Connect Secure zero-day — CVE-2026-104935 (CVSS 8.6), actively exploited, CISA KEV Auth bypass by spoofing → unauthenticated RCE on

    threataft.com · 3h ago · October 14th, 2026

26. update from en.hacks.gr

    Security researchers detailed an attack chain combining three vulnerabilities in Ivanti Connect Secure VPN appliances, enabling unauthentica

    en.hacks.gr · 3h ago · October 14th, 2026

    Security researchers detailed an attack chain combining three vulnerabilities in Ivanti Connect Secure VPN appliances, enabling unauthentica

    via Mastodon https://en.hacks.gr/epiplokes-se-systima-tis-ivanti-kathos-agnostoi-mpikan-me-tria-provlimata-asfaleias/

27. mentioned by www.volexity.com

    🤖 Chained Ivanti Connect Secure zero-days exploited in the wild (UTA0576) for unauthenticated root RCE, against a fully patched 22.8R2.4 app

    www.volexity.com · 1h ago · October 14th, 2026