grep -rl "CVE-2026-104935" ./articles
Volexity documented a three-stage zero-day chain against Ivanti Connect Secure. Two stages were patched on 13 October under one identifier. The third, a privilege escalation to root, is still open — and Ivanti's own integrity checker does not see any of it.
Root Notes reports on this identifier; it does not maintain it. For the vendor advisory, the affected versions and the scoring, NVD and MITRE hold the primary records.
CISA added this identifier to its Known Exploited Vulnerabilities catalog on 2026-10-13, which means the agency has evidence of exploitation rather than a judgement that exploitation is possible. US federal agencies were required to remediate it by 2026-10-16.
Volexity documented a three-stage zero-day chain against Ivanti Connect Secure. Two stages were patched on 13 October under one identifier. The third, a privilege escalation to root, is still open — and Ivanti's own integrity checker does not see any of it.
../cve — every identifier we have covered