Ivanti Connect Secure zero-day exploited in the wild (CVE

Reporting by Rapid7 BlogRead the original at rapid7.com

Executive Summary

A high-severity authentication bypass vulnerability, CVE-2026-104935, was disclosed by Ivanti on October 13, 2026, affecting Ivanti Connect Secure (ICS). The vulnerability has a CVSSv3.0 score of 8.6 and allows a remote, unauthenticated attacker to execute arbitrary commands. Exploitation had already occurred in the wild before public disclosure, as confirmed by CISA's addition to the Known Exploited Vulnerabilities catalog. Digital forensics firm Volexity reported threat actor activity detected in early October 2026, noting that an unpatched privilege escalation vulnerability was also exploited concurrently. Ivanti acknowledged discovering and patching a portion of the vulnerability in the July 2026 release 25.1.3.0, but exploitation occurred while backporting the fix to other versions. Rapid7 recommends emergency patching for affected systems immediately. Remediation involves applying specific updates depending on the affected Ivanti Connect Secure version.

Facts Only

* Ivanti published a security advisory for CVE-2026-104935 on October 13, 2026.
* The vulnerability is an authentication bypass by spoofing (CWE-290).
* The vulnerability affects Ivanti Connect Secure (ICS).
* The CVSSv3.0 score is 8.6.
* Exploitation in the wild occurred prior to disclosure, indicating zero-day activity.
* CISA added CVE-2026-104935 to its Known Exploited Vulnerabilities (KEV) catalog on October 13, 2026.
* Volexity published a blog post describing threat actor activity detected in early October 2026.
* Threat actors leveraged CVE-2026-104935 and an unpatched privilege escalation vulnerability.
* Ivanti patched a portion of the vulnerability in release 25.1.3.0 during development.
* Affected versions of Ivanti Connect Secure include 25.1.1.1 and prior, 25.1.2.2 and prior, and 22.8R2.4 and prior.
* Versions 22.7.x and below are confirmed to be unaffected.

Full Take

The narrative structure presents a tension between vendor responsibility in patching and the reality of active exploitation that occurs outside official disclosure channels. The pattern observed is one where technical fixes are introduced incrementally, yet the catastrophic consequences of exposure are revealed through third-party reporting, suggesting a gap between internal security processes and external threat reality. The inclusion of an unpatched privilege escalation vulnerability alongside the primary zero-day points toward systemic vulnerabilities in the software lifecycle where remediation often addresses only the surface issue rather than the full attack chain. The reliance on external bodies like CISA and third-party firms to confirm exploitation underscores a necessary shift away from trust in internal disclosure alone, forcing organizations to adopt proactive verification methods regardless of vendor statements. This situation highlights the imperative for cognitive sovereignty: recognizing that official vulnerability management timelines often lag behind active threat actor timelines, demanding that protective action is based on confirmed external signals rather than waiting for full internal consensus.
Bridge Questions: How can security teams establish independent verification mechanisms when relying on vendor disclosure alone? What structural changes are needed in incident response protocols to account for the possibility of simultaneous, multi-vulnerability exploitation? If organizations operate under the assumption that exploits are occurring before patching is complete, how does that change risk tolerance and resource allocation for emergency remediation?

From the original · Rapid7 Blog

Overview On October 13, 2026, Ivanti published a security advisory for CVE-2026-104935, a high-severity authentication bypass by spoofing (CWE-290) affecting Ivanti Connect Secure (ICS). The vulnerability has a CVSSv3.0 score of 8.6 and allows a remote, unauthenticated attacker to execute arbitrary commands.

Read the full story at rapid7.com

Sentinel — Human

Confidence

The text reads like a factual summary of a cybersecurity incident, relying on specific technical citations and established reporting structures rather than pure narrative generation.

Signals Detected

Moderate sentence length variance and standard journalistic flow.

Clear, focused reporting on a technical incident with necessary context provided by multiple named entities (Ivanti, CISA, Volexity).

The information flows logically from the vulnerability announcement to exploitation confirmation, actor detail, and mitigation steps.

References to specific CVEs, dates, and named entities suggest adherence to real-world reporting structures.

Human Indicators

The inclusion of specific, cross-referenced technical details (CVE numbers, version numbers) and the citation of multiple external bodies (Ivanti, CISA, Volexity, Rapid7) points toward human aggregation of verifiable data.

The tone shifts appropriately between reporting facts and issuing recommendations, characteristic of security advisories or high-level news reporting.