Ivanti patches a Connect Secure bug already under attack
CVE-2026-104935 lets an unauthenticated attacker bypass login on Ivanti Connect Secure and run commands. Ivanti confirms limited exploitation, and CISA gives federal agencies until 16 October to patch.
Ivanti disclosed CVE-2026-104935 on 13 October, an authentication bypass by spoofing in Connect Secure that lets a remote, unauthenticated attacker slip past the login check and run arbitrary commands on the appliance. Ivanti rates it 8.6 on the CVSS scale and says in its advisory: “We are aware of exploitation in the wild affecting a limited number of customers at the time of disclosure.” CISA added it to the Known Exploited Vulnerabilities catalogue the same day, with a remediation deadline of 16 October for federal civilian agencies.
The bug affects Connect Secure 25.1.1.1 and earlier, 25.1.2.2 and earlier, and 22.8R2.4 and earlier. Fixes are out now: 25.1.1.2, 25.1.3.0 or 25.1.3.1, and 22.8R2.5, depending on which branch you’re running.
Why it matters: Connect Secure sits at the network edge as a VPN gateway, so an unauthenticated path to command execution there is a direct route into whatever network it fronts. If you run it, patch now rather than on your usual cycle, not least because Ivanti’s gateway products have a history of exploitation widening fast once a bug is public.
The caveat: Ivanti describes the current exploitation as limited to a small number of customers, not a mass campaign, but that has changed quickly for this product line before.