Ivanti Connect Secure
CVE-2026-104935: the exploited Ivanti Connect Secure authentication bypass.
An authentication bypass by spoofing in Ivanti Connect Secure lets a remote attacker with no credentials run arbitrary commands on the appliance. It was exploited before Ivanti disclosed it and is listed by CISA as exploited.
Exploitation
- Exploitation
- Exploited in the wild
- CISA KEV
- Listed 13 Oct 2026
- Federal due date 16 Oct 2026; catalogue read 31 Oct 2026
- EPSS
- 87% in 30 days
- Percentile 100%, scored 29 Oct 2026
- 8.6High, (CVSS 3.1)Scored by NVD
- 87%EPSS, chance of exploitation in 30 daysPercentile 100%; scored 29 Oct 2026
- 13 OctPublished by NVD13 Oct 2026; record read 13 Oct 2026
Versions
Affected and fixed.
.
| Affected | Fixed in |
|---|---|
| Connect Secure 22.8R2.4 and earlier | 22.8R2.5 |
| 25.1.2.2 and earlier | 25.1.3.0 or 25.1.3.1 |
| 25.1.1.1 and earlier | 25.1.1.2 |
What to do now
Upgrade every Connect Secure appliance to a fixed build now, then hunt for signs of compromise. The steps, the indicators and the Essential Eight mapping sit in our advisory.
How to check exposure
The running build shows in the appliance's administrative console on its system overview, and in the output of the version command Ivanti documents. Any build below the fixed ones is exposed; the 22.7R2.14 branch and earlier are not affected, as the NVD record states.
The Ivanti security advisory, opens in a new tab names the fixed builds and the Integrity Checker Tool. A clean result from that tool is weak evidence against this attacker, who tampered with logs; the logs shipped off the appliance are the record to review.
Who this reaches in Australia
Connect Secure is the remote access gateway of mid-sized Australian firms, councils and health services that bought it as a VPN appliance and left it on the internet by design. It sits in front of identity, so a bypass here reaches everything the VPN reaches.
Under the Essential Eight the fix belongs to patch operating systems: an internet-facing device with a working exploit carries the model's 48 hour window at every maturity level.
Timeline
Disclosed, published, listed, advised.
- : Published by NVD
- : Added to the CISA Known Exploited Vulnerabilities Catalog
- : NVD record last modified
- : CISA due date for US federal agencies
Questions, answered.
Is CVE-2026-104935 exploited?
Yes. CISA added it to the Known Exploited Vulnerabilities Catalog on 13 October 2026, the day Ivanti disclosed it.
Which Connect Secure versions are fixed?
22.8R2.5, 25.1.1.2, 25.1.3.0 and 25.1.3.1. The 22.7R2.14 branch and earlier are not affected. Every other build is exposed until it is upgraded.
Does an upgrade remove an attacker who was already in?
No. An upgrade closes the flaw and leaves in place anything set up before it. The advisory's hunt steps, credential rotation and log review follow the upgrade.
Provenance
Sources, and when they were read.
Every source was read 31 Oct 2026.
- 1NVD, CVE-2026-104935NIST. US Government work, public domain.
- 2CISA, Known Exploited Vulnerabilities CatalogUS Government work, public domain.
- 3FIRST, EPSS score for CVE-2026-104935EPSS terms of use.
- 4Black Shard, Essential Eight assessment
- 5Black Shard, Ivanti Connect Secure zero-day CVE-2026-104935 exploited in a three-flaw chain
- 6Vendor reference for CVE-2026-104935: hub.ivanti.comivanti.com. terms of use.