On October 13, Ivanti disclosed that attackers had exploited an authentication-bypass flaw in Connect Secure, its remote-access VPN appliance. CVE-2026-104935 allows unauthenticated remote attackers to execute commands on affected versions. Ivanti described a limited number of affected customers; independent reporting based on Volexity's investigation provides additional detail about the activity and a separate, still-unpatched flaw in the wider chain.
The disclosed flaw and affected versions
The CVE record identifies CVE-2026-104935 as an authentication-bypass weakness in Ivanti Connect Secure. It affects specified 22.8 and 25.1 releases before their October fixes; Ivanti's advisory lists the exact affected and fixed builds. Ivanti says 22.7R2.14 and earlier are not affected by this CVE. Administrators should compare their running branch and build against the vendor table rather than infer exposure from the product name alone.
What investigators observed
Volexity says it found evidence of exploitation beginning October 3 and tracked the activity to an actor it calls UTA0576. Its investigation describes three chained zero-day flaws that enabled unauthenticated root-level access on a fully patched appliance. Ivanti addressed two issues at disclosure, while the third privilege-escalation vulnerability still awaited a fix. Keep the scope clear: this wider chain is not the effect of CVE-2026-104935 by itself.
Why the gateway matters
Connect Secure provides remote access to corporate resources. Volexity reports that the investigated actor searched for domain credentials, collected limited Active Directory metadata, conducted reconnaissance, and tampered with logs. These are observations from that investigation, not proof that every vulnerable appliance experienced the same actions or that every customer was affected.
Patch, then assess exposure
Install the fixed release Ivanti lists for your branch, confirm the gateway is running it, and check that any high-availability peers were updated too. If the appliance was internet-facing while vulnerable, preserve relevant logs and review authentication, configuration, and network activity. Volexity's report says the actor could evade the Integrity Checker by re-exploiting the appliance for commands and changing logs; administrators should not treat one clean checker result as a complete assurance where there are signs of targeting.
The connection with Soclyde
An exposed VPN can put credentials used for remote access and internal services at risk. Soclyde can help teams keep those account secrets distinct and share them with authorised colleagues, but it cannot patch an Ivanti appliance or establish whether it was compromised. See the secure password generator guide for a practical way to avoid password reuse.
What to remember
Ivanti confirmed exploitation of CVE-2026-104935 and published fixes on October 13. Update the affected branch, then investigate gateway and network activity if the appliance may have been targeted. The secure password generator guide covers a separate but useful credential-control step.
