2026-11-02: Cybercriminals can take over Ivanti Connect Secure VPN gateways without a password

Ivanti Connect Secure, the VPN gateway many organizations use to give employees remote access to the corporate network, contains an authentication bypass vulnerability that lets cybercriminals run commands on the appliance without logging in. They do this by spoofing requests so the gateway treats them as trusted, and Ivanti has confirmed that CVE-2026-104935, which carries an 8.6 out of 10 (High) CVSS score, is actively exploited.

Read Ivanti's security advisory (external link).

How the vulnerabilities work

CVE-2026-104935 is an authentication bypass by spoofing. A remote, unauthenticated attacker can get past the gateway's login checks and execute arbitrary commands on the appliance from anywhere on the internet.

Two more vulnerabilities complete the chain seen in the wild:

• CVE-2026-118527 (4.3, Medium) uses predictable filenames, letting an authenticated attacker write files with attacker-controlled content to a known location on disk.
• CVE-2026-111357 (8.8, High, according to Ivanti) is missing authentication for a critical function, letting a local authenticated attacker escalate privileges.

Why this is dangerous

Security firm Volexity found a threat actor it tracks as UTA0576 using the chain against a customer from October 3. According to Volexity, the first two vulnerabilities gave the attacker code execution on the gateway, and the third raised that to root.

The appliance was running 22.8R2.4, fully patched at the time. The attacker left no backdoor on disk and re-ran the chain for every command instead, and because the exploit changes code only in memory, Ivanti's Integrity Checker Tool doesn't detect it.

A VPN gateway sits at the edge of the corporate network and handles employee logins. Cybercriminals who control it can capture credentials, watch traffic, and move into the internal network. Ivanti says exploitation has affected a limited number of customers.

Affected software

CVE-2026-104935 affects these Ivanti Connect Secure versions:

• 22.8 before 22.8R2.5

• 25.x before 25.1.1.2
• 25.1.2.x before 25.1.3.0

Versions 22.7R2.14 and earlier aren't affected.

CVE-2026-111357 and CVE-2026-118527 affect these versions:

• 22.8 before 22.8R2.6

• 25.x before 25.1.1.3

 Versions 22.7.x and earlier, and 25.1.3.0 and later, aren't affected.

Mitigation & next steps

Ivanti fixed CVE-2026-104935 on October 13 in 22.8R2.5, 25.1.1.2, 25.1.3.0, and 25.1.3.1. Those first fixes only close the entry point of the chain. On October 29, Ivanti released fixes for the other two vulnerabilities and urges customers to upgrade to:

• 22.8R2.6

• 25.1.1.3, or later

Versions 25.1.3.0 and later, which run on the ISA4500, ISA6500, and ISA8500 platforms, don't contain any of the three vulnerabilities. Customers on 25.1.2.x need to move to 25.1.3.0, which requires the new hardware or a new virtual appliance built from the 25.1.3.0 template. The 22.7 and 22.8 lines both reach end of life on January 31, 2027, and Ivanti recommends moving to 25.1.

Ivanti hasn't published a workaround. In the meantime, it advises customers to:

• Review the indicators of compromise Volexity published
• Run the Integrity Checker Tool regularly
• Follow Ivanti's recovery steps if they suspect a compromise

CISA added CVE-2026-104935 to its KEV Catalog on October 13. It gave federal agencies until October 16 to act. It added CVE-2026-111357 and CVE-2026-118527 on October 30.

See CISA's KEV Catalog entry for CVE-2026-104935 (external link).

Holm Security's response

Holm Security has released tests to scan for these vulnerabilities:

• HID-2-1-5418674 - Ivanti Connect Secure 22.8 < 22.8R2.5 / 25.0 < 25.1.1.2 / 25.1.2 < 25.1.3.0 Authentication Bypass Vulnerability (CVE-2026-104935) (October 2026)
• HID-2-1-5416555 - Ivanti Connect Secure 22.8 < 22.8R2.6 / 25.0 < 25.1.1.3 Multiple Vulnerabilities (October 2026)