Attackers exploit an Ivanti Connect Secure flaw that allows unauthenticated command execution

What happened

A vulnerability tracked as CVE-2026-104935 has been disclosed in Ivanti Connect Secure (ICS), Ivanti's remote access gateway. According to the description published in NVD, it is an authentication bypass by spoofing: an attacker can impersonate a legitimate user or component, get past access controls and execute arbitrary commands on the device.

The flaw carries a CVSS score of 8.6 (high). It can be exploited over the network, without credentials or any user interaction, and with low attack complexity. The main impact is on the confidentiality of data, with more limited effects on system integrity and availability.

Exploitation status

CISA added CVE-2026-104935 to its Known Exploited Vulnerabilities (KEV) catalog on 13 October 2026, confirming that it is already being used in real-world attacks. US federal agencies have been given until 16 October 2026 to remediate, just three days, which underlines how urgent this is.

It is not yet known whether the vulnerability is being used in ransomware campaigns, and the available data does not say who is behind the attacks or how widespread they are. At least two specialist outlets have reported on the flaw in the past seven days.

Who is affected

Organisations running Ivanti Connect Secure versions earlier than 25.1.3.0 are affected. The description specifies that version 22.7R2.14 and earlier are not impacted, so the vulnerable range covers versions later than 22.7R2.14 and earlier than 25.1.3.0.

Because remote access gateways are usually exposed to the internet, any vulnerable deployment should be treated as being at immediate risk.

What to do

With active exploitation confirmed, immediate action is recommended. Concrete steps:

• Inventory all Ivanti Connect Secure appliances and check which version each one runs.
• If the version is later than 22.7R2.14 and earlier than 25.1.3.0, urgently upgrade to 25.1.3.0 or later, which the description indicates is not affected. Confirm the fixed version and any additional mitigations with Ivanti.
• If you cannot upgrade right away, restrict internet access to the appliance as tightly as possible until the update is applied.
• Review device logs for unusual logins, unexpected commands or unknown accounts, as the appliance may have been compromised before being updated.
• If you find any sign of intrusion, handle it as a compromise: isolate the appliance, rotate associated credentials and certificates, and look for lateral movement into the internal network.

Affected technologies

Vulnerabilities (1)