Ivanti Connect Secure Authentication Bypass Exploited for Remote Command Execution

Ivanti disclosed active exploitation of CVE-2026-104935, a high-severity authentication-bypass vulnerability in Connect Secure that allows remote, unauthenticated attackers to execute arbitrary commands. The flaw carries a CVSS score of 8.6 and was exploited against a limited number of customers before disclosure. CISA confirmed exploitation and added it to its Known Exploited Vulnerabilities catalog. Volexity reported that attackers also used a separate, still-unpatched privilege-escalation vulnerability; the supplied reports do not identify the attackers.

Ivanti lists 25.1.1.2, 25.1.3.0, 25.1.3.1, and 22.8R2.5 as fixed releases and states that versions 22.7.x and earlier are unaffected. Version 25.1.3.0 included an initial fix in July, with remaining updates released on October 5 as remediation extended across supported versions. Organizations should treat affected appliances as an emergency patching priority, follow platform-specific migration requirements, and investigate possible compromise even after updating. Ivanti recommends reviewing Volexity’s published indicators, regularly running its Integrity Checker Tool, and following its recovery procedures when exploitation is suspected; patching alone should not be treated as evidence that an appliance is uncompromised.