# Ivanti Connect Secure zero-day exploited in wild

Published: 2026-10-14 · Severity: severe · Sectors: government-national, technology, telecommunications
Canonical: https://vorant.io/reports/4396b290-b2a8-54a4-aac9-359e5e841331/ivanti-connect-secure-zero-day-exploited-in-wild

> CERT-FR warns a critical Ivanti Connect Secure vulnerability (CVE-2026-104935) is being actively exploited for remote code execution and privilege escalation.

CERT-FR issued an alert on a vulnerability in Ivanti Connect Secure (ICS) that Ivanti confirms is being actively exploited in the wild. The flaw, tracked as CVE-2026-104935, affects ICS versions 22.8Rx prior to 22.8R2.5, 25.1.1.x prior to 25.1.1.2, and 25.1.3.x prior to 25.1.3.1. Successful exploitation allows an attacker to bypass security policy, execute arbitrary code remotely, and escalate privileges — a combination that typically leads to full device compromise and lateral movement into internal networks via stored LDAP/Active Directory credentials.

Volexity published a companion report describing chained exploitation of ICS zero-days and associated indicators of compromise. CERT-FR's guidance emphasizes immediate isolation of affected appliances, forensic capture (disk/memory snapshots) before shutdown, log preservation, and use of Ivanti's Integrity Checker Tool (ICT) — noting that ICT requires physical access and may cause service interruption. CERT-FR explicitly notes awareness of lateral movement using compromised LDAP/AD secrets extracted from affected gateways.

Defenders running affected ICS versions should treat any potentially compromised appliance as fully compromised: reset LDAP/AD secrets, revoke and reissue all certificates (client/server/code-signing/TLS), reset admin passwords and API keys, reset local and service account credentials, revoke Kerberos tickets, and reset license server authentication. A factory reset is recommended but CERT-FR warns some threats may persist through reset in sensitive contexts. Organizations without an available patch should disconnect appliances from the Internet where possible and monitor LDAP/AD service account activity closely. This is a high-urgency event given confirmed active exploitation and known lateral movement using harvested credentials.

## Mentioned in this report

- Vulnerabilities: CVE-2026-104935 (KEV)

Source reporting: https://www.cert.ssi.gouv.fr/alerte/CERTFR-2026-ALE-013

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/4396b290-b2a8-54a4-aac9-359e5e841331/ivanti-connect-secure-zero-day-exploited-in-wild.
In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), live profiles of the actors and CVEs it names, and the vendor research on the same campaign. Slack alerts fire on the vendors, sectors and countries a reader follows. A new account starts with three days of all of it, no card: https://vorant.io/signup