Exploited Ivanti zero-day gets PoC for sale on dark web
An authentication bypass flaw in the Ivanti Connect Secure VPN (CVE-2026-104935) lets a remote unauthenticated attacker execute arbitrary commands. Exploitation as a zero-day is confirmed, CISA added the CVE to its KEV catalog, and a dark web seller now offers a PoC for $3,000 claiming root escalation and theft of passwords and keys. Upgrade now to 25.1.1.2, 25.1.3.0/25.1.3.1, or 22.8R2.5 and hunt for compromise even after patching.
What happened
On October 13, 2026, Ivanti disclosed a flaw in its enterprise VPN, Connect Secure (CVE-2026-104935), and confirmed limited exploitation among real customers before the advisory. CISA added the CVE to its KEV catalog the same day. Now, according to dbugs, a dark web seller offers a proof of concept for $3,000.
Why it matters
Connect Secure sits at the network edge and the flaw allows command execution without any login. A PoC for sale lowers the cost of attack and turns every unpatched appliance into a target. The seller claims the exploit gains root and extracts admin password hashes plus LDAP/AD, RADIUS, SAML, and Azure keys, exposing corporate credentials.
What to do
Upgrade immediately to 25.1.1.2, 25.1.3.0/25.1.3.1, or 22.8R2.5, outside normal patch cycles, as Rapid7 recommends. Run the Integrity Checker Tool regularly and investigate signs of compromise even after patching, using the IOCs published by Volexity. Note: the attack chain also uses a privilege escalation flaw that remains unpatched.
For the technical team
- CVE
- CVE-2026-104935
- Affected
- Ivanti Connect Secure (ICS) · Ivanti Connect Secure 25.1.1.1 and prior; 25.1.2.2 and prior; 22.8R2.4 and prior (applicable code lines). Versions 22.7.x and below are unaffected, per the vendor.
- Exploitation
- Zero-day exploitation before the October 13, 2026 advisory; Ivanti reports a limited number of customers and CISA added the CVE to KEV on disclosure day. Volexity detected the activity in early October 2026. On October 26, 2026, dbugs reported a dark web PoC sale for $3,000; the seller claims tests in lab environments and two real targets.
- Fix
- Upgrade to 25.1.1.2; 25.1.3.0 or 25.1.3.1; or 22.8R2.5. Ivanti advises running the Integrity Checker Tool regularly and following vendor recovery steps if compromise is suspected. Partial fix: the chained privilege escalation flaw remains unpatched, with a fix planned for a later date.
- Vector
- Authentication bypass by spoofing (CWE-290) in Ivanti Connect Secure, high severity with CVSSv3.0 8.6 per Rapid7. A remote, unauthenticated attacker executes arbitrary commands. The PoC seller claims the exploit works over the standard HTTPS port, without credentials, and escalates to root. Volexity documents chained use with a still-unpatched privilege escalation flaw.
- More details
- Ivanti states reliable IOCs are not available, but Volexity has published indicators. Per Rapid7, part of the flaw was found through Ivanti's product security program and fixed in 25.1.3.0 in July 2026; exploitation occurred while the fix was being backported to other supported versions. The seller claims data exfiltration may be restricted on 22.8+ builds with hardened SELinux; the listing describes the PoC as Pre-Auth RCE with a 9.0 score. Rapid7 recommends emergency patching outside normal cycles. The product had other zero-days exploited in 2024 and 2025.
Timeline
Volexity and Ivanti detail a chained zero-day with a PoC for sale.
Sources 5 sources
- Volexity: Chained Exploitation of Ivanti Connect Secure Zero-Days Volexity
- Ivanti October 2026 Security Update Ivanti
- BleepingComputer: Ivanti warns of Connect Secure zero-day BleepingComputer
- Ivanti Connect Secure zero-day exploited in the wild (CVE-2026-104935) Rapid7
- Sale of a PoC for a vulnerability in Ivanti Connect Secure (CVE-2026-104935) dbugs
