Ivanti Connect Secure, CVE-2026-104935: on CISA's exploited list

The bottom line

If you run Ivanti Connect Secure, treat this as urgent: CISA's deadline of 16 October 2026 has already passed. First find your version, and if it is below 25.1.3.0 on the 25.1 line, get it patched and checked for compromise.

Free analysis report · 8 pagesIvanti Connect Secure, CVE-2026-104935: on CISA's exploited listThe same note as a document you can keep or forward: what the sources say, who is affected, and what to do first.Download the analysis report →

At a glance

Does this apply to you?

What it is

An attacker on the network, with no login, can pretend to be a legitimate user and make the appliance run commands of their choosing. The record calls this an authentication bypass by spoofing.

Why it matters

The record says no login is needed and the result is command execution on the appliance. Our reading is that a remote access gateway sits between the internet and your internal network, so an attacker who controls it is well placed to reach what lies behind it. The record's score and the exploitation listing both point the same way, so do not wait for a routine patch cycle.

Exposure by situation

These priorities are our judgement from what the sources say about who can use the flaw and how. They are not vendor ratings.

Things people will get wrong

• "Our version is old, so we are safe." Not always. The record says 22.7R2.14 and earlier are not affected, but it gives no range for the other versions. Check the exact version.
• "It needs a valid login first." The record describes a remote, unauthenticated attacker. A login is not required.

How we would triage it

This is our judgement.

Step 1: Find the versions you run

• Ask whoever manages the appliance for the exact Connect Secure version.
• Compare it with the unaffected versions the record lists: 25.1.3.0, 25.1.3.1, 22.8R2.5 and 22.7R2.14.

Step 2: Reduce exposure

• If you cannot patch today, ask your provider whether access from the internet can be restricted until you can.
• Follow the vendor's mitigation instructions, as CISA's required action says.

Step 3: Patch to an unaffected version

• Move to a version the record lists as unaffected.
• The record names no workaround, and no vendor page could be read. Get the vendor's own instructions.

Step 4: Check for compromise

• Because exploitation is listed, ask your provider to review the appliance for signs of misuse, not only to patch it.
• Ask for the result in writing.

To close it, read the version from the product itself, not from an old inventory, and save the output with the date. If you cannot update today, write down who owns it, the new date, and what limits exposure until then.

Send this to your IT provider

Copy it, change the names and dates, and send it. It is a draft for you to check, not a template tested with any provider.

Hello, we need to know whether we run Ivanti Connect Secure, and if so on which version. This concerns CVE-2026-104935, an authentication bypass that lets an unauthenticated attacker run commands. The record lists 25.1.3.0, 25.1.3.1, 22.8R2.5 and 22.7R2.14 as unaffected. CISA's deadline of 16 October 2026 has passed. Please confirm in writing which version each appliance runs, whether it is patched, and whether you have checked it for signs of compromise. Please reply by a date you propose this week. Thank you.

Signs it was used

An update closes the hole. It does not tell you whether someone used it first. CISA's required action points to its forensic triage requirements (BOD 26-04). Look for:

• Sign-ins or admin sessions on the appliance that nobody on your team can account for.
• Commands, new files or changed settings on the appliance that no one on your team made.
• Unexpected outbound connections from the appliance to addresses you do not recognise.

The weakness behind it

The record classes this as CWE-290 (Authentication Bypass by Spoofing).

• CWE-290: Authentication Bypass by Spoofing →What this kind of mistake is, and which exploited vulnerabilities share it.

The sources, in their words

CISA's catalogue entry:

Ivanti Connect Secure contains an authentication bypass by spoofing vulnerability that allows a remote unauthenticated attacker to execute arbitrary commands.

The CVE record, published by Ivanti on 13 October 2026:

Authentication bypass by spoofing in ICS before version 25.1.3.0 allows a remote unauthenticated attacker to execute arbitrary commands. This does not impact ICS version 22.7R2.14 or prior.

It lists these as unaffected:

• 25.1.3.0
• 25.1.3.1
• 22.8R2.5
• 22.7R2.14

CISA's required action:

Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes).

What we do not know yet

• Which versions between 22.7R2.14 and 25.1.3.0 are affected: the record gives no ranges, only unaffected versions.
• What the vendor's advisory says about fixes or workarounds: no vendor page could be read.
• How attacks are carried out, and what signs they leave on the appliance.
• We have not tested this against any environment. Versions and scores are as the sources state them and as at 1 November 2026; the vendor's advisory wins where it differs.
• The sections headed "The bottom line", "Does this apply to you?", "What it is", "Why it matters", "Exposure by situation", "Things people will get wrong", "How we would triage it" and "Send this to your IT provider" are our interpretation of the sources, not a statement by CISA or the vendor.

• Today's mission →Every exploited vulnerability from the last seven days, in the order their deadlines fall.
• The CVE Triage Handbook →How to check, analyse and triage a CVE. Free with registration.