Attackers broke into Ivanti Connect Secure VPN appliances using a flaw nobody outside Ivanti knew about, and the vendor only published its advisory on October 13, 2026. The bug, tracked as CVE-2026-104935, lets a remote attacker with no login run commands on the device, according to an analysis by Rapid7.
Ivanti says the flaw was exploited before disclosure against a limited number of customers, which makes this a true zero-day. CISA confirmed active exploitation and added it to the Known Exploited Vulnerabilities catalog on the same day Ivanti went public.
A login check that can be fooled
Ivanti classes the bug as an authentication bypass by spoofing (CWE-290), meaning the appliance can be tricked into trusting someone it should not. It carries a CVSSv3.0 score of 8.6. Rapid7's summary does not go into the technical mechanics, and Ivanti's advisory is the place for that detail.
Connect Secure is a widely deployed enterprise VPN that sits on the edge of corporate networks, which is exactly what makes it valuable to intruders. The product has been hit by zero-day exploitation before, in both 2024 and 2025.
Volexity saw a second, still unpatched bug
The intrusions were spotted in early October 2026 by digital forensics firm Volexity, which has published a detailed write-up of the attacker's activity. Volexity reports that the attacker paired CVE-2026-104935 with a privilege escalation flaw that remains unpatched, which Ivanti plans to fix at a later date. Rapid7's summary does not name the threat actor.
There is an awkward twist in the timeline. Ivanti says part of the vulnerability was found by its own product security program and fixed in the July 2026 release, version 25.1.3.0. The exploitation took place while Ivanti was still backporting that fix to its other supported versions.
Update to 25.1.1.2, 25.1.3.0 or 22.8R2.5 now
Ivanti lists these affected and fixed builds:
- 25.1.1.1 and earlier: update to 25.1.1.2
- 25.1.2.2 and earlier: update to 25.1.3.0 or 25.1.3.1
- 22.8R2.4 and earlier: update to 22.8R2.5
Versions 22.7.x and below are not affected. Rapid7 recommends applying the update on an emergency basis, outside normal patch cycles. Ivanti says it has no reliable indicators of compromise to share, but Volexity has published several, and Rapid7 urges teams to look for signs of compromise even after patching. Customers who suspect exploitation should follow the recovery steps in Ivanti's advisory.
This is not the first Ivanti product to come under fire this year: a critical Ivanti Sentry flaw was exploited in June after a public exploit appeared. With Connect Secure the lesson keeps repeating. When the box at the network edge is the target, a patch closes the door, but only a hunt tells you whether someone already walked through it.
This briefing is provided by IntelFusions for informational and defensive purposes only. It is based on sources assessed to be reliable at the time of writing, and analytic judgments carry the confidence levels indicated. Indicators of compromise are defanged; re-arm them only in controlled environments. IntelFusions is not affiliated with the organizations named and makes no warranty as to completeness or accuracy.