CVE-2026-104935

Think of your company's VPN like the front door to your office network that remote employees use to get in securely. This flaw is like a fake master key — an outsider doesn't need a password at all, they just trick the lock into thinking they belong, then they can walk around and give orders inside. Because attackers are already using this trick in the real world, the risk isn't theoretical.

This matters to you if you run Ivanti Connect Secure to give employees remote access to your network. It affects all versions before 25.1.3.0; devices on 22.7R2.14 or earlier are not affected by this specific issue. Because Connect Secure is typically exposed to the internet by design, this is reachable by any remote attacker without needing a login.

This is a red-alert situation: attackers are already exploiting this flaw in the wild, and the US cybersecurity agency (CISA) has set a remediation deadline of October 16, 2026 for government and critical systems — a signal of how seriously this is being treated. Act now rather than waiting for a routine patch cycle.

Confirm exposure by checking whether your Connect Secure appliance is internet-facing (which is the normal deployment model) and identify its exact build version. Target fixed versions per branch: 25.1.3.0 or 25.1.3.1 on the 25.1.x line, 25.1.1.2 on the 25.1.1.x line, and 22.8R2.5 on the 22.8.x line; devices on 22.7R2.14 or earlier are unaffected and do not require this patch. Review Ivanti's advisory for any branch-specific upgrade notes or breaking changes before applying. If immediate patching isn't possible, apply Ivanti's published interim mitigations and restrict internet exposure of the management/auth interfaces as a stopgap — do not rely on this as a long-term fix. CISA's KEV entry sets a remediation due date of 2026-10-16; federal guidance under BOD 26-04 also directs organizations to evaluate internet exposure and discontinue use if mitigation is unavailable. After patching, monitor authentication logs and command execution activity on the appliance for signs of prior compromise, since exploitation predates this advisory.

CVSS 3.1 score 8.6 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L) reflects a low-complexity, unauthenticated network attack with high confidentiality impact. Weakness is CWE-290 (Authentication Bypass by Spoofing), enabling arbitrary command execution. Listed in CISA KEV as of 2026-10-13 confirming active exploitation in the wild, with a remediation due date of 2026-10-16; no public exploit code/PoC is currently on record, meaning exploitation is being driven by threat actors' private tooling rather than widely available scripts. Given confirmed KEV exploitation, EPSS prediction is not the operative signal here — treat exploitation as established fact.