Ivanti Connect Secure CVE-2026-104935 is patched, but the root escalation in the same exploit chain is not

Ivanti shipped fixes for an exploited Connect Secure zero-day on October 13, 2026, and the CVE record it filed as numbering authority is short: "Authentication bypass by spoofing in ICS before version 25.1.3.0 allows a remote unauthenticated attacker to execute arbitrary commands." That is CVE-2026-104935, scored 8.6 (CVSS 3.1). CISA added it to the Known Exploited Vulnerabilities catalog the same day.

The more useful document is the write-up from Volexity, which found the intrusion. It shows CVE-2026-104935 was one part of a three-flaw chain, and that the third link was not fixed on October 13.

What Ivanti fixed, and in which versions

The CVE record lists 25.1.3.0, 25.1.3.1 and 22.8R2.5 as unaffected, and states that the flaw "does not impact ICS version 22.7R2.14 or prior." Ivanti's October security blog says the company "is aware of limited exploitation in the wild" and that "If you are running one of the impacted versions, Ivanti recommends you act immediately." It also tells customers to run the Integrity Checker Tool regularly. The authoritative version table is in Ivanti's advisory on its support hub, which did not render for us; the version list here comes from the CVE record Ivanti filed.

Secondary listings of affected versions disagree with each other (one national CERT lists "25.2.2 and prior," press reports say 25.1.2.2), so check the advisory itself before deciding a box is safe.

The chain, and the link still open

Volexity's investigation began on October 5 at a monitoring customer. The appliance was, in its words, "fully patched (at the time, version 22.8R2.4)." The actor, tracked as UTA0576, had been exploiting it since at least October 3. Volexity describes a chain of an authentication bypass, a file-write code execution flaw and a privilege escalation to root, and says CVE-2026-104935 covers the first two.

On the third, Volexity says "Ivanti is working on a fix for the privilege escalation vulnerability" and that it will ship "in a future release in the coming weeks." On October 15 MITRE published CVE-2026-111357 for a privilege escalation in Connect Secure 22.8R2.4 involving how the "dsinvoked broker trusts DSCache configuration data," scored 7.0 and recorded as exploited in the wild in October 2026, with Volexity's post as its reference. The Canadian Centre for Cyber Security updated its Ivanti alert on October 16 to note that open-source reporting indicates CVE-2026-111357 is being exploited. Neither record says which Ivanti release fixes it.

The privilege escalation needs local access, so patching CVE-2026-104935 removes the unauthenticated way in. It does not remove root for anyone who already has a foothold.

Why the Integrity Checker missed it

This is the part defenders should read twice. Volexity writes that "The Ivanti Integrity Checker may not be able to identify device compromise." The firm "did not identify first-stage malware or web shells." Instead, "For each command executed by UTA0576, the entire exploit chain is executed," with library code patched in memory only and configuration restored afterward, leaving nothing on disk to compare against. The payload also removed recent entries from the debug and audit logs.

After access, Volexity observed credential theft, Active Directory and LDAP reconnaissance, password spraying and data exfiltration. It assesses with medium confidence that UTA0576 "makes use of large language models."

What to do

• Upgrade to a fixed release (25.1.3.0, 25.1.3.1 or 22.8R2.5 per the CVE record), then watch for the privilege escalation fix.
• Do not treat a clean Integrity Checker result as proof. Volexity says "forensic investigation is required to identify evidence of exploitation," including memory analysis.
• Look for the request patterns Volexity lists: high volumes of requests to the public login CGI path, and mismatches between the requested URL path and an internal path header. Check /tmp for leftover artifacts.
• Treat lateral movement from the VPN appliance as a sign of compromise and investigate the internal hosts it reached.

Primary sources: CVE-2026-104935 record (Ivanti, CNA), Ivanti October 2026 security update, Ivanti advisory, Volexity: A Series of Unauthenticated Events, CVE-2026-111357 record, Canadian Centre for Cyber Security AV26-1035, read 2026-10-20.