IVANTI CONNECT SECURE ZERO

X • October 14, 2026

Dark Web Intelligence @DailyDarkWeb 🚨 IVANTI CONNECT SECURE ZERO-DAY CHAIN EXPLOITED TO STEAL CREDENTIALS (CVE-2026-104935) Ivanti disclosed a new Connect Secure (ICS) VPN flaw on Oct 13, 2026 and says it is aware of limited exploitation in the wild. CISA added it to the KEV catalog the same day. Volexity published the incident behind it. What Volexity found: • An unknown actor it tracks as UTA0576 exploited the chain from Oct 3, 2026 against a then fully patched appliance (22.8R2.4) • Auth bypass + race-condition RCE (both CVE-2026-104935), chained with a separate privilege-escalation bug for root • No backdoor or web shell: the actor re-ran the exploit for every command, then deleted log entries • Post-exploitation: LDAP/AD credential theft, searches for LAPS passwords and BitLocker recovery keys, password spraying, packet capture Fix: follow Ivanti's advisory for your appliance's fixed build (the CVE record lists 22.8R2.5 and 25.1.3.0/25.1.3.1 as unaffected). Ivanti says a fix for the privilege-escalation bug is still coming. CISA federal due date: Oct 16, 2026. ⚠️ Analyst Note: A clean Integrity Checker result does not rule this out. The chain patches code in memory only and restores state, so Volexity says memory and network forensics are needed. Watch for heavy requests to /dana-na/auth/url_default/welcome.cgi with an X-DSCGI-PATH header that doesn't match the URL. No victim count is established, and Volexity's attribution (criminal, low confidence) is tentative. Advisory: hub.ivanti.com/s/article/Secu… Research: volexity.com/blog/2026/10/1… #DDW #DarkWeb #Ivanti #ZeroDay #CVE #KEV #ThreatIntelligence #CyberSecurity 6:01 PM · Oct 13, 2026 · 4,545 Views 2

Dark Web Intelligence @DailyDarkWeb 10h Full technical write-up from Volexity: A Series of Unauthenticated Events: Chained Exploitation of Ivanti Connect Secure Zero-Days From volexity.com

@Jeuri @Jeuri2406 9h @ DailyDarkWeb KEV same-day is the signal. If you still run Connect Secure: patch now, kill unused admin accounts, and require MFA on the management plane. Zero-days love forgotten VPN portals.

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Ivanti Connect Secure Zero-Day CVE-2026-104935 Exploited in the Wild On October 13, 2026, Ivanti disclosed a high-severity zero-day vulnerability tracked as CVE-2026-104935, affecting its Connect Secure (ICS) VPN appliances. This authentication bypass flaw allows unauthenticated attackers to execute arbitrary commands, with exploitation confirmed since at least October 1. The vulnerability impacts versions 25.1.1.1 and earlier, 25.1.2.2 and earlier, and 22.8R2.4 and earlier. Security firm Volexity identified the exploitation chain, which includes two patched vulnerabilities and one unpatched privilege escalation flaw. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added the CVE to its Known Exploited Vulnerabilities catalog on the same day as the disclosure, urging immediate patching. Organizations are advised to apply the latest updates and conduct forensic investigations to check for signs of compromise. 43 sources 73

Extracted Entities

IVANTI CONNECT SECURE ZERO

The full story

Extracted Entities

Attack Types (1)

Companies (1)

CVEs (1)

CWE Weaknesses (1)

Domains (2)

MITRE ATT&CK (2)

Platforms (1)