{"id":"ivanti-connect-secure-auth-bypass-oct-2026","category":"patch","status":"live","title":"Ivanti Connect Secure authentication bypass CVE-2026-104935 used in attacks; fixes for most branches","tldr":"Ivanti Connect Secure VPN appliances have a login-bypass flaw (CVE-2026-104935) that lets attackers run commands without an account, and it is being used in attacks. If you run one, update now: 25.1.1.2, 25.1.3.x or 22.8R2.5. Home users are not affected.","summary":"CVE-2026-104935 is an authentication bypass by spoofing in Ivanti Connect Secure, a VPN gateway that businesses use to give staff remote access. It allows a remote attacker with no account to run commands on the appliance, needs no user interaction, and carries a CVSS score of 8.6. Ivanti disclosed it on 13 October 2026 and said it had been used against a limited number of customers before then; CISA listed it as exploited the same day. Affected builds are 25.1.1.1 and earlier, 25.1.2.2 and earlier, and 22.8R2.4 and earlier. Version 22.7R2.14 and earlier is reported as not affected. ITdaily reports fixes in 25.1.1.2 (released 5 October), 22.8R2.5 (12 October) and 25.1.3.0 and 25.1.3.1, but names no fixed build for the 25.1.2.x branch, so that gap is not confirmed. Ivanti's own advisory could not be loaded when this record was written, so version details come from the press and two government alerts. Few signs of compromise are available; Volexity published indicators, and Ivanti asks customers to run its Integrity Checker Tool. Sources differ on when attacks began.","action":"If your business runs Ivanti Connect Secure, update to 25.1.1.2, 25.1.3.1 or 22.8R2.5 and run Ivanti's Integrity Checker Tool. If you are on 25.1.2.x, confirm your fixed build with Ivanti. Ask your IT provider if you are unsure.","product":"Ivanti Connect Secure VPN gateway","audience":"work","severity":"high","patch":"partial","exploited":true,"cves":["CVE-2026-104935"],"tags":["ivanti","connect-secure","vpn","authentication-bypass","zero-day","cisa-kev","remote-code-execution"],"affected":["Ivanti Connect Secure 25.1.1.1 and prior","Ivanti Connect Secure 25.1.2.2 and prior","Ivanti Connect Secure 22.8R2.4 and prior"],"fixed":["25.1.1.2","25.1.3.0","25.1.3.1","22.8R2.5"],"matches":[],"sources":[{"kind":"advisory","title":"Security Advisory Ivanti Connect Secure (CVE-2026-104935)","url":"https://hub.ivanti.com/s/article/Security-Advisory-Ivanti-Connect-Secure-CVE-2026-104935","by":"Ivanti","date":"2026-10-13"},{"kind":"news","title":"Ivanti patches flaw in Connect Secure that attackers are already exploiting","url":"https://itdaily.com/news/business/ivanti-bug-ics-2026/","by":"ITdaily","date":"2026-10-13"},{"kind":"advisory","title":"Ivanti Connect Secure Remote Code Execution Vulnerability","url":"https://www.hkcert.org/security-bulletin/ivanti-connect-secure-remote-code-execution-vulnerability_20261014","by":"HKCERT","date":"2026-10-14"},{"kind":"advisory","title":"Active Exploitation of Vulnerability in Ivanti Connect Secure","url":"https://www.csa.gov.sg/alerts-and-advisories/alerts/al-2026-147/","by":"Cyber Security Agency of Singapore","date":"2026-10-20"}],"started":"2026-10-13","closed":null,"created":"2026-11-03T21:57:06.952Z","updated":"2026-11-03T21:57:06.952Z","cve_notes":[{"cve":"CVE-2026-104935","name":"Authentication bypass in Ivanti Connect Secure VPN","what":"An authentication bypass by spoofing in Ivanti Connect Secure that lets a remote attacker with no account run commands on the VPN appliance.","severity":"high","cvss":8.6}],"timeline":[{"at":"2026-10-20","added":"2026-11-03T21:56:13.587Z","kind":"other","text":"Singapore's Cyber Security Agency issued an alert listing affected builds 25.1.1.1 and earlier, 25.1.2.2 and earlier, and 22.8R2.4 and earlier, and told organisations to update to the latest versions. The page was last updated on 3 November 2026.","url":"https://www.csa.gov.sg/alerts-and-advisories/alerts/al-2026-147/","by":"Cyber Security Agency of Singapore","patch":null},{"at":"2026-10-14","added":"2026-11-03T21:56:13.587Z","kind":"other","text":"Hong Kong's HKCERT rated the risk Extremely High, said the flaw is being exploited in the wild and listed no workarounds, only the vendor's fixes.","url":"https://www.hkcert.org/security-bulletin/ivanti-connect-secure-remote-code-execution-vulnerability_20261014","by":"HKCERT","patch":null},{"at":"2026-10-13","added":"2026-11-03T21:56:13.587Z","kind":"disclosed","text":"Ivanti disclosed CVE-2026-104935, an authentication bypass in Connect Secure rated CVSS 8.6, and said attackers had already used it against a limited number of customers. CISA added it to its list of flaws used in attacks the same day.","url":"https://itdaily.com/news/business/ivanti-bug-ics-2026/","by":"ITdaily","patch":"partial"}],"url":"https://hard.fyi/live/ivanti-connect-secure-auth-bypass-oct-2026/","json":"https://hard.fyi/api/live?id=ivanti-connect-secure-auth-bypass-oct-2026"}