Urgent awareness alert. This is awareness content, not a monitored threat intelligence service: always check vendor advisories against your own environment.
Ivanti has released fixes for CVE-2026-104935, an authentication bypass (CVSS 8.6) in Ivanti Connect Secure, its widely used remote access VPN. A remote, unauthenticated attacker can use it to run arbitrary commands. Ivanti says the flaw was exploited before disclosure against a limited number of customers, and on 13 October 2026 the US Cybersecurity and Infrastructure Security Agency (CISA) added it to its Known Exploited Vulnerabilities catalogue and urged organisations to patch. Volexity, which found the attacks, reports that the attackers chained it with a privilege escalation flaw that Ivanti has not yet fixed to gain root access to fully patched appliances, then stole domain credentials stored on the appliance and searched Active Directory for further passwords and recovery keys. Affected versions are 22.8R2.4 and earlier, 25.1.1.1 and earlier, and 25.1.2.2 and earlier; versions 22.7 and earlier are not affected.
What to do:
- Upgrade now to 22.8R2.5, 25.1.1.2, or 25.1.3.0 or later, outside your normal patch cycle, and apply Ivanti’s fix for the privilege escalation flaw as soon as it is released.
- Check for compromise even after patching: review appliance and Active Directory logs for unusual activity, and follow Ivanti’s recovery guidance if you suspect exploitation. Volexity reports that Ivanti’s Integrity Checker did not detect this compromise.
- Restrict exposure: limit access to the appliance’s management interface, and reset domain and service account credentials stored on the appliance if you find signs of compromise.
Source: Ivanti security advisory for CVE-2026-104935
If you would like help assessing your exposure, contact us.
