NewsCompaniesFlawsGuides
Get the app
HighPartly fixedBeing used in attacksUpdated

Ivanti Connect Secure authentication bypass CVE-2026-104935 used in attacks; fixes for most branches

Ivanti Connect Secure VPN appliances have a login-bypass flaw (CVE-2026-104935) that lets attackers run commands without an account, and it is being used in attacks. If you run one, update now: 25.1.1.2, 25.1.3.x or 22.8R2.5. Home users are not affected.

What to do

If your business runs Ivanti Connect Secure, update to 25.1.1.2, 25.1.3.1 or 22.8R2.5 and run Ivanti's Integrity Checker Tool. If you are on 25.1.2.x, confirm your fixed build with Ivanti. Ask your IT provider if you are unsure.

What’s happening

CVE-2026-104935 is an authentication bypass by spoofing in Ivanti Connect Secure, a VPN gateway that businesses use to give staff remote access. It allows a remote attacker with no account to run commands on the appliance, needs no user interaction, and carries a CVSS score of 8.6. Ivanti disclosed it on 13 October 2026 and said it had been used against a limited number of customers before then; CISA listed it as exploited the same day. Affected builds are 25.1.1.1 and earlier, 25.1.2.2 and earlier, and 22.8R2.4 and earlier. Version 22.7R2.14 and earlier is reported as not affected. ITdaily reports fixes in 25.1.1.2 (released 5 October), 22.8R2.5 (12 October) and 25.1.3.0 and 25.1.3.1, but names no fixed build for the 25.1.2.x branch, so that gap is not confirmed. Ivanti's own advisory could not be loaded when this record was written, so version details come from the press and two government alerts. Few signs of compromise are available; Volexity published indicators, and Ivanti asks customers to run its Integrity Checker Tool. Sources differ on when attacks began.

What
Flaw
Affects
Ivanti Connect Secure VPN gateway
Affected
Ivanti Connect Secure 25.1.1.1 and prior
Ivanti Connect Secure 25.1.2.2 and prior
Ivanti Connect Secure 22.8R2.4 and prior
Fixed in
25.1.1.2
25.1.3.0
25.1.3.1
22.8R2.5
CVE
CVE-2026-104935
Since
13 Oct 2026

Timeline

  1. Update

    Singapore's Cyber Security Agency issued an alert listing affected builds 25.1.1.1 and earlier, 25.1.2.2 and earlier, and 22.8R2.4 and earlier, and told organisations to update to the latest versions. The page was last updated on 3 November 2026.

  2. Update

    Hong Kong's HKCERT rated the risk Extremely High, said the flaw is being exploited in the wild and listed no workarounds, only the vendor's fixes.

  3. Made publicPartly fixed

    Ivanti disclosed CVE-2026-104935, an authentication bypass in Connect Secure rated CVSS 8.6, and said attackers had already used it against a limited number of customers. CISA added it to its list of flaws used in attacks the same day.

Sources

  1. Security Advisory Ivanti Connect Secure (CVE-2026-104935)Ivanti · 13 Oct 2026
  2. Ivanti patches flaw in Connect Secure that attackers are already exploitingITdaily · 13 Oct 2026
  3. Ivanti Connect Secure Remote Code Execution VulnerabilityHKCERT · 14 Oct 2026
  4. Active Exploitation of Vulnerability in Ivanti Connect SecureCyber Security Agency of Singapore · 20 Oct 2026
HARD Live follows this until it’s over: each change is added to the timeline with its source. Everything live · Everything from October 2026 · JSON · RSS