TechPulse
CVE-2026-104935 HIGH · CVSS 8.8 · Ivanti — Ivanti Infrastructure ·

CVE-2026-104935: CVE-2026-104935 (Ivanti Connect Secure)

Ivanti's October 13 fix closed the front door, but not the privilege escalation attackers chained behind it. If you upgraded to 25.1.1.2 or 22.8R2.5 last month, you have to upgrade again.

Identifier
CVE-2026-104935
Vendor / Product
Ivanti · Ivanti Infrastructure
Severity / CVSS
HIGH · CVSS 8.8
Vector / CWE
CWE-Other (Security Advisory)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected
Ivanti Connect Secure 22.8Rx before 22.8R2.6, 25.1.1.x before 25.1.1.3, 25.1.2.x before 25.1.3.1 (25.1.3.x is not affected by CVE-2026-111357 / CVE-2026-118527)
Patched Version
Ivanti Connect Secure 22.8R2.6, 25.1.1.3, 25.1.3.1
Priority
P1 — Scheduled Security Update

Executive Summary & Technical Impact

Ivanti's October 13 fix closed the front door, but not the privilege escalation attackers chained behind it. If you upgraded to 25.1.1.2 or 22.8R2.5 last month, you have to upgrade again.

Tracked under CVE-2026-104935 (CWE-Other (Security Advisory)), this vulnerability affects Ivanti Connect Secure 22.8Rx before 22.8R2.6, 25.1.1.x before 25.1.1.3, 25.1.2.x before 25.1.3.1 (25.1.3.x is not affected by CVE-2026-111357 / CVE-2026-118527) and carries a severity score of 8.8 (HIGH). Engineering and security operations teams running Ivanti Infrastructure should prioritize upgrading to Ivanti Connect Secure 22.8R2.6, 25.1.1.3, 25.1.3.1.

Remediation & Patch Guidance

  1. On October 29, Ivanti added two more actively exploited Connect Secure (ICS) flaws to its October 13 advisory: CVE-2026-111357 (CVSS 8.8, privilege escalation to root) and CVE-2026-118527 (CVSS 4.3, predictable upload path).
  2. Both were chained with the already-patched auth bypass/RCE CVE-2026-104935 to get unauthenticated root on fully patched appliances. CISA added them to KEV on October 30, with federal deadlines of November 2 and November 13.
  3. The fixes are in 22.8R2.6 and 25.1.1.3. Those versions replace 22.8R2.5 and 25.1.1.2, the builds many teams installed for the October advisory, so a second upgrade is needed.
  4. Volexity says the attacker patched code in memory and scrubbed logs, so Ivanti's Integrity Checker may not see a compromise. CERT-FR says it knows of lateral movement using LDAP/AD secrets taken from these devices, so rotate them.

Frequently Asked Questions (CVE-2026-104935)

What versions are affected by CVE-2026-104935?

CVE-2026-104935 affects Ivanti Connect Secure 22.8Rx before 22.8R2.6, 25.1.1.x before 25.1.1.3, 25.1.2.x before 25.1.3.1 (25.1.3.x is not affected by CVE-2026-111357 / CVE-2026-118527) in Ivanti Infrastructure (CVE-2026-104935 (Ivanti Connect Secure)).

How do I patch or remediate CVE-2026-104935?

Upgrade affected deployments to Ivanti Connect Secure 22.8R2.6, 25.1.1.3, 25.1.3.1 and verify the remediation steps listed above.

What is the CVSS score of CVE-2026-104935?

CVE-2026-104935 is rated HIGH with a CVSS score of 8.8 (vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

Full TechPulse Investigation

Ivanti Connect Secure: The Last Two Zero-Days in an Unauthenticated Root Chain Are Now Patched (CVE-2026-111357, CVE-2026-118527)

Ivanti's October 13 fix closed the front door, but not the privilege escalation attackers chained behind it. If you upgraded to 25.1.1.2 or 22.8R2.5 last month, you have to upgrade again.

Read full engineering post-mortem (6 min read) →

Official Vendor & NVD Advisory Links

  1. SecurityWeek — Ivanti Patches Two More Zero-Days Exploited in Connect Secure Attack Chain
  2. Volexity — A Series of Unauthenticated Events: Chained Exploitation of Ivanti Connect Secure Zero-Days
  3. CISA — CISA Adds Two Known Exploited Vulnerabilities to Catalog (Oct 30, 2026)
  4. CERT-FR — CERTFR-2026-ALE-013 Multiples vulnérabilités dans Ivanti Connect Secure (updated Nov 2)
  5. The Hacker News — Attackers Chain Three Ivanti Connect Secure Flaws to Gain Unauthenticated Root Access
  6. Ivanti Security Advisory — Ivanti Connect Secure (CVE-2026-104935)
  7. NVD — CVE-2026-104935 Official Record

Other Active Runtime & Infrastructure CVEs

View All in CVE Index →
CVE-2026-97229 CI/CD regular expression compiler (Ruby Onigmo regex engine) CRITICAL · 10.0 (CVSS 3.1, GitLab) CVE-2026-112816 Remote API mutual-TLS client authentication (certificate chain matching) CRITICAL · 10.0 (CVSS 4.0, Canonical) CVE-2026-116241 Import/Export Data tool (psql \copy query-export guard) CRITICAL · 9.9 (CVSS 3.1, PostgreSQL CNA) CVE-2026-98432 IPv4 request-socket options (inet_opt / ireq_opt) in tcp_v4_syn_recv_sock and request-socket migration CRITICAL · 9.8 (CVSS 3.1, Linux kernel CNA) CVE-2026-110186 Code generation service (reachable through MCP tool enumeration) CRITICAL · 9.8 (CVSS 3.1, IBM) CVE-2026-93680 Auto-login security control CRITICAL · 9.8 (CVSS 3.1, IBM)