Do Son 
TL;DR
Ivanti disclosed CVE-2026-104935 on October 13, 2026, and confirmed the flaw is already exploited in the wild. The Ivanti Connect Secure vulnerability lets a remote, unauthenticated attacker run arbitrary commands. Fixed versions are available now.
Why It Matters
Connect Secure is a VPN gateway that sits at the network edge. A breach can therefore give attackers a foothold inside corporate networks.
Ivanti’s security advisory for CVE-2026-104935 states it plainly: “We are aware of exploitation in the wild affecting a limited number of customers at the time of disclosure.”
Ivanti credits Volexity for helping on the case. Volexity also helped uncover the Connect Secure zero-days that attackers mass-exploited in early 2024.
How the Attack Works
The flaw is an authentication bypass by spoofing, tracked as CWE-290. An attacker can slip past the login check without valid credentials. From there, they can execute arbitrary commands on the appliance. Ivanti rates it CVSS 8.6 (High).
Exploitation status
Ivanti confirms active exploitation against a limited number of customers. At the time of writing, CISA had not yet added the flaw to its KEV catalog. No public proof-of-concept has been confirmed.
Affected Versions
- Ivanti Connect Secure 25.1.1.1 and prior (fixed in 25.1.1.2)
- 25.1.2.2 and prior (fixed in 25.1.3.0 and 25.1.3.1)
- 22.8R2.4 and prior (fixed in 22.8R2.5)
Ivanti notes the flaw “does not impact ICS version 22.7R2.14 or prior.”
Patch and Mitigation Steps
- On 22.8.x, move to 25.1.1.2 or later. If that is not possible yet, apply 22.8R2.5.
- On 25.1.1.1 (ISA6000 or ISA8000), update to 25.1.1.2.
- Plan the move off 22.7 and 22.8, since both reach end of life on January 31, 2027.
- Review logs for signs of compromise, given the active attacks.
Ivanti also urges teams to stay current: “We always recommend customers upgrade their solution to the latest version to benefit from important security enhancements and features.” With this Ivanti Connect Secure vulnerability already under attack, patching should not wait.
Support Our Threat Intelligence
Find our vulnerability reports and weekly recaps helpful? Support our work today and unlock a 100% ad-free reading experience!
Buy Me a Coffee
