Update Ivanti Connect Secure to 25.1.3+ to Stop Unauthenticated Remote Command Execution via CVE-2026-104935
Ivanti confirms zero-day exploitation of CVE-2026-104935, allowing remote command execution without credentials on affected VPN appliances.
Key points
- CVE-2026-104935 is a high-severity authentication bypass in Ivanti Connect Secure.
- Exploitation occurred in the wild before the October 13, 2026 disclosure.
- Versions 25.1.3.0 and later resolve the issue; earlier releases are vulnerable.
Ivanti Connect Secure appliances are facing active exploitation of a critical authentication bypass. The vendor disclosed CVE-2026-104935 on October 13, 2026, confirming that attackers had already compromised a limited number of customers. This flaw allows remote, unauthenticated users to execute arbitrary commands on the system. Because the product sits at the network edge, successful exploitation grants immediate access to internal resources.
The risk
The vulnerability carries a CVSS score of 8.6, rated as high severity. It is classified as an authentication bypass by spoofing, mapped to CWE-290. Attackers can exploit this flaw over a network without needing valid credentials or user interaction. The National Vulnerability Database notes that the issue affects Ivanti Connect Secure versions prior to 25.1.3.0. This means any deployment running older builds is susceptible to remote code execution.
Who is exposed
Organizations running Ivanti Connect Secure versions 25.1.1.1 and earlier, 25.1.2.2 and earlier, or 22.8R2.4 and earlier are affected. Ivanti states that versions in the 22.7 branch and lower do not contain this vulnerability. The vendor initially patched a portion of the flaw in version 25.1.3.0, released in July 2026. However, exploitation occurred while Ivanti worked to backport the fix to other supported versions, leaving many customers exposed during that window.
Cost and compliance
CISA added CVE-2026-104935 to its Known Exploited Vulnerabilities catalog on October 13, 2026. The agency set a federal due date of October 16, 2026, for remediation. Stakeholders must apply mitigations in accordance with vendor instructions. This action ensures compliance with CISA’s Binding Operational Directive 26-04, which prioritizes security updates based on risk. Organizations must also evaluate internet exposure for each asset to meet these federal guidelines.
Our take on the response
Ivanti confirmed that reliable indicators of compromise are not currently available. This makes detection difficult for security operations teams relying on signature-based alerts. Volexity published detailed threat actor activity detected in early October 2026, including the use of an unpatched privilege escalation flaw. Teams should assume that affected appliances may be compromised even if no specific IOCs are present.
What defenders should look for
Teams usually monitor for anomalous outbound connections from edge appliances. Check whether administrative sessions were initiated without corresponding user login events. Look for unexpected command executions or process spawns on the VPN gateway. Verify that no new accounts were created or modified. Isolate suspected devices from the network immediately to prevent lateral movement. Preserve forensic images before applying patches to aid in later investigation.
Background: Authentication bypass vulnerabilities
Authentication bypass vulnerabilities allow users to access systems without valid credentials. They occur when applications fail to verify identity correctly at critical decision points. Developers must enforce server-side validation, avoid client-side trust, and implement strict session management to prevent unauthorized access to protected resources.
Read the full guide: Authentication Bypass Vulnerabilities: How They Work and How to Fix Them
What to do and how to stay safe
- Identify all Ivanti Connect Secure instances running versions 25.1.1.1, 25.1.2.2, or 22.8R2.4 and earlier.
- Apply vendor-supplied updates to version 25.1.3.0 or later, or 22.8R2.5 if migration is not possible.
- Review network logs for unauthorized command execution or unusual traffic patterns from VPN gateways.
- Consult Ivanti’s recovery instructions if exploitation is suspected, as no reliable IOCs are available.
Step-by-step guide: Unpatched Software Response: Containment, Recovery, and Prevention Steps
General security guidance from the BlueTeam Herald newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Which Ivanti Connect Secure versions are vulnerable to CVE-2026-104935?
Versions 25.1.1.1 and earlier, 25.1.2.2 and earlier, and 22.8R2.4 and earlier are affected. Versions
