Ivanti Connect Secure CVE-2026-104935 Exploited: Patching Doesn't Prove You Weren't Already Rooted

Ivanti Connect Secure CVE-2026-104935 is a triple zero-day vulnerability chain that Ivanti disclosed on 13 October 2026, granting unauthenticated attackers root-level code execution on Connect Secure VPN appliances. Volexity tracked exploitation by a threat actor called UTA0576 to at least 3 October 2026, and CISA added the flaw to its Known Exploited Vulnerabilities catalog the same day it was disclosed.

Key takeaways

• CVE-2026-104935 chains three previously unknown Ivanti Connect Secure flaws, including an authentication bypass by spoofing, into unauthenticated root access.
• Volexity traced active exploitation to 3 October 2026, roughly ten days before Ivanti's public disclosure and patch release.
• Ivanti shipped patches for two additional zero-days chained into the same attack in late October 2026, meaning the story kept moving after the first fix.
• Applying the patch closes the vulnerability going forward, it does not tell you whether the appliance was already compromised during the exploitation window, which is where monitoring outside the device matters.

What is CVE-2026-104935 and what makes it a triple zero-day chain?

CVE-2026-104935 is a vulnerability chain affecting Ivanti Connect Secure, the vendor's SSL VPN appliance, that combines three separate flaws to let an unauthenticated attacker reach root-level code execution. The chain opens with an authentication bypass achieved by spoofing, which means an attacker doesn't need valid credentials to start the process.

From there, attackers used the chain to gain root access and steal credentials stored on or passed through the appliance. That's the part that matters for any organization relying on Connect Secure as a trust boundary between the internet and the internal network: once root is achieved, the appliance is no longer a gateway you control, it's infrastructure the attacker controls temporarily on your behalf.

Who's affected and what's the real timeline?

Any organization running an exposed, unpatched Ivanti Connect Secure appliance during the exploitation window is potentially affected, not just the organizations already identified publicly. The sequence matters more than the single patch date:

Ten days of unauthenticated root-level exploitation before public disclosure is the detail that should change how every MSSP talks to clients about this. CISA has a well-established pattern of adding Ivanti Connect Secure flaws to its KEV catalog, which tells you this isn't a one-off appliance having a bad month.

Why doesn't patching Connect Secure prove you weren't already rooted?

Because a patch fixes the door, not the fact that someone may have already walked through it. Vendor-supplied integrity checking tools, the kind Ivanti and others ship for appliance self-verification, are generally built to catch unauthorized changes to the file system and configuration state. They were not designed to catch activity that happens purely in memory and clears on reboot, which is exactly the category of exploitation this chain enables once an attacker reaches code execution.

That's not a knock on the concept of integrity checking, it's a scope limitation. A filesystem integrity check that passes cleanly tells you the files look right today. It tells you nothing about whether credentials were harvested, sessions were hijacked, or lateral movement occurred during the window the appliance was vulnerable. Treating a clean integrity scan as proof of a clean appliance is the kind of logic that feels reassuring right up until it isn't.

What should MSSPs and partners actually do now?

First, patch. That part isn't optional and it isn't in dispute. But patching should trigger a second workstream, not close the ticket:

• Assume the appliance may have been compromised during the exploitation window and treat it as a potential initial access point, not a cleared asset.
• Rotate credentials that transited the appliance, including any identity federation or VPN authentication secrets, since the chain was used to steal credentials.
• Hunt for anomalous authentication and session activity in logs generated outside the appliance itself, not just the appliance's own reporting.
• Loop in incident response services if there's any indication of post-exploitation activity rather than waiting for a second alert to confirm it.

Where Vijilan's Global SOC fits into this

Vijilan Security's Global SOC is built around exactly the gap this incident exposes, out-of-band detection that doesn't depend on the compromised device telling you the truth about itself. When an appliance's own integrity tooling can't see in-memory exploitation, network traffic patterns, authentication logs, and endpoint telemetry from the broader environment become the only reliable signal.

ThreatHunt™ proactively looks for the kind of anomalous session and lateral movement behavior this chain produces, while managed identity threat detection and response is the right lens for the credential theft component specifically. 24/7 SOC monitoring catches the authentication anomalies that an appliance-side check will never see, because the appliance was the thing lying to begin with.

For MSSP partners managing Connect Secure deployments across multiple clients, we never compete with our partners for their clients.