CISA forces a same-week Ivanti patch: the Connect Secure authentication-bypass zero-day is already moving
Threat actors are chaining a spoofing-based auth bypass with a second bug to reach unauthenticated root on internet-facing gateways - and thousands of exposed appliances are still unpatched.
CISA has added Ivanti Connect Secure (ICS) to its Known Exploited Vulnerabilities catalog, demanding that federal agencies fix the flaw by 2026-10-16 - a tight three-day window that reflects an attack already in motion. The bug, tracked as CVE-2026-104935, is a high-severity authentication-bypass-by-spoofing vulnerability that lets a remote, unauthenticated threat actor execute arbitrary commands on targeted ICS systems in low-complexity attacks that need no user interaction.
The entry, added 2026-10-13 and first reported by CISA today, notes limited exploitation in the wild and urges admins to apply Ivanti mitigations immediately. Ivanti shipped ICS releases 22.8R2.5, 25.1.3.0, 25.1.3.1 and 25.1.1.2 on Tuesday to address the issue, warning customers to act now.
Why this flaw is dangerous
Connect Secure is an edge appliance - a VPN / SSO gateway - that commonly sits directly on the public internet as the front door to internal network traffic. That placement makes it a prime target: whoever controls the gateway controls the trust boundary. Researchers from Volexity described the campaign as chaining CVE-2026-104935 with a second remote-code-execution and a privilege-escalation bug to reach unauthenticated root-level code execution, and said they first saw attackers abusing it in the wild on 1 October.
The operators are not just probing - they are stealing. Volexity detailed access to Active Directory credentials and secrets, including LAPS (Local Administrator Password Solution) passwords and BitLocker recovery keys. Defused independently confirmed the same pattern. The combination of an internet-facing foothold and credential theft is exactly the profile of an operation building toward deeper persistence and lateral movement.
How bad is the exposure
- Attacks need no user click - a fully remote, no-interaction foothold on unpatched gateways
- The flaw is a spoofing-based auth bypass: valid-seeming requests are treated as trusted without proper verification
- Chained with an RCE and a privilege-escalation bug, it yields unauthenticated root on the appliance
- Attackers are harvesting AD credentials, LAPS passwords and BitLocker recovery keys for follow-on access
- Internet threat watchdog Shadowserver now tracks more than 5,600 internet-exposed hosts showing ICS fingerprints
What this means for you
If your network uses Ivanti Connect Secure as a VPN or single-sign-on entry point, assume it is a top-tier target. Patch to one of the affected-versions fix releases now, hunt for signs of credential theft (AD, LAPS, BitLocker secrets), and restrict or segment internet exposure of the appliance. If you cannot patch fast enough, follow CISA guidance and drop or discontinue the service rather than relying on an unverified workaround.
Sources: CISA Known Exploited Vulnerabilities catalog; BleepingComputer: CISA warns admins to immediately fix Ivanti flaw exploited as zero-day; Ivanti Security Advisory - ICS CVE-2026-104935.
Corrections: Report an error at corrections@wireshaman.com.