CVE-2026-104935 is a zero-day in Ivanti Connect Secure giving remote attackers unauthenticated command execution on the appliance. Threat actor UTA0576 chains it with an auth bypass and a privilege escalation to full root. CISA added it to the Known Exploited Vulnerabilities catalog on October 13 with a remediation deadline of October 16, 2026 (today). Paste your ICS version into this CVE checker for an instant verdict against the published version tables. Free, runs entirely in your browser, nothing is sent anywhere.
Key figure: CISA's Known Exploited Vulnerabilities catalog listed 1,748 entries as of October 16, 2026, every one confirmed exploited in the wild (CISA KEV catalog, version 2026.10.16).
CVE-2026-104935 is major cybersecurity news because it allows unauthenticated remote-code execution as root on Ivanti Connect Secure VPN appliances — the front door to corporate networks. VPN flaws are prized by ransomware groups, and Ivanti devices have been mass-exploited before. Check your version with the tool above and patch immediately.
| Your branch | Vulnerable | Patch to |
|---|---|---|
25.1.1.x | 25.1.1.1 and earlier | 25.1.1.2 |
25.1.2.x | 25.1.2.2 and earlier | 25.1.3.0 / 25.1.3.1 (move to the 25.1.3 line) |
25.1.3.x | — | 25.1.3.0 / 25.1.3.1 (fixed) |
22.8R2.x | 22.8R2.4 and earlier | 22.8R2.5 |
22.7 line | Not affected (22.7R2.14 and prior) | |
Source of these tables: the Ivanti advisory as reported October 2026. Always match the fix to your branch; cross-branch upgrades are not required.
This page checked one CVE. BreachHunter hunts attacker infrastructure and compromise indicators — the footholds attackers keep after the initial exploit.
CVE-2026-104935 is a zero-day in Ivanti Connect Secure that allows remote, unauthenticated command execution on the VPN appliance. Threat actor UTA0576 chains it with an authentication bypass and a privilege escalation to reach unauthenticated root. Volexity reported the flaw; CISA added it to the Known Exploited Vulnerabilities catalog on October 13, 2026 with a remediation due date of October 16, 2026.
Affected: ICS 25.1.1.1 and earlier, 25.1.2.2 and earlier, and 22.8R2.4 and earlier. Not affected: the 22.7 line (22.7R2.14 and prior). If your version is on one of the affected lines below the fixed build, treat the appliance as compromised until proven otherwise.
Match the fixed build to your branch: 25.1.1.2 for the 25.1.1 line, 25.1.3.0 or 25.1.3.1 for the 25.1.3 line (the 25.1.2 line should upgrade to 25.1.3.0/25.1.3.1), and 22.8R2.5 for the 22.8 line. Ivanti has noted a separate privilege-escalation fix is still pending, so keep watching for further updates.
The exploit chain runs entirely in memory, leaving nothing on disk for the Integrity Checker Tool to inspect. A clean integrity check therefore proves nothing here. If your appliance was internet-facing on a vulnerable build during the exploitation window, hunt with network and firewall logs from outside the appliance instead.
Per CISA: patch immediately, then treat a suspected appliance as compromised. Isolate it, perform a factory reset, rebuild from known-good configuration and media, rotate all credentials and certificates, review external logs for attacker activity, and report findings to CISA. Patching closes the hole but does not remove footholds an attacker already planted.
A CVE checker is a free tool that tells you whether your software is affected by a published CVE — a publicly known cybersecurity vulnerability. It compares your version or configuration against the official advisory and gives you a patched, vulnerable, or unknown verdict in about 30 seconds.
Find your exact version number, then compare it against the vendor's security advisory or the NVD entry for the CVE. The fastest way is a CVE checker built for that product: paste your version and get an instant verdict against the published version tables.
You are affected when you run a vulnerable version and the vulnerable component is reachable or enabled — for example, open sign-ups, an exposed management port, or a vulnerable app installed. A CVE checker gives you the version verdict in seconds; the advisory's conditions tell you whether that verdict means real exposure.