Ivanti VPN bypass, actively exploited

CVE-2026-104935 is a high-severity authentication bypass in Ivanti Connect Secure (ICS), the SSL VPN formerly sold as Pulse Connect Secure and originally as Juniper Pulse. A remote attacker with no credentials can trigger it in a low-complexity attack that needs no user interaction, and the payoff is arbitrary command execution on the appliance. Ivanti told customers on Tuesday to patch immediately and says it has seen limited exploitation in the wild.

The flaw affects ICS 22.8R2.4 and earlier, 25.1.2.2 and earlier, and 25.1.1.1 and earlier. Fixed builds are available, and upgrading is the recommended action.

Volexity found and reported the bug, and its account is the reason to treat this as more than a single CVE. A threat actor it tracks as UTA0576 has been chaining CVE-2026-104935 with two other flaws since at least October 3 to reach unauthenticated root-level code execution on fully patched devices. Defused, which confirmed the activity independently, says it saw the first signs on October 1.

The tradecraft is the part worth reading twice. UTA0576 deployed no malware and no web shell. It re-exploited the device for every command it ran and tampered with logs to cover its tracks, which let it slip past Ivanti’s Integrity Checker Tool. That matters because the Integrity Checker Tool is exactly what Ivanti’s advisory tells you to run regularly to detect compromise. Running it is still worth doing, but on these devices against this actor a clean result is not evidence of a clean box.

There is a second catch in the patch guidance. Ivanti has fixed two of the three flaws in the chain and is still working on a privilege escalation vulnerability that UTA0576 used. Patching now closes the authentication bypass that opens the door, so it is still the right move, but the full chain is not yet remediated. Treat any ICS appliance that was exposed before you patched as potentially touched, and hunt accordingly rather than assuming the upgrade cleans up after itself.

Scope is wide enough to matter. Shadowserver counts more than 5,500 ICS instances reachable on the internet, though it cannot say how many are honeypots or already secured. Ivanti lists more than 40,000 customers.

Ivanti gateways have been a reliable way into enterprise networks for years, usually as zero-days. In early January 2024 Ivanti patched an authentication bypass (CVE-2023-46805) and a command injection (CVE-2024-21887), followed two weeks later by a server-side request forgery (CVE-2024-21893). January 2025 brought an RCE (CVE-2025-0282), and a second RCE (CVE-2025-22457) was exploited by China-linked actors from at least mid-March 2025. CISA has flagged 36 actively exploited vulnerabilities across Ivanti products since November 2021, twelve of them abused by ransomware gangs.

If you run ICS, upgrade to the fixed version now, run the Integrity Checker Tool with the understanding that a clean result does not rule out this actor, and go looking for log tampering and signs of re-exploitation rather than dropped files.