Ivanti Connect Secure zero-day exploited before disclosure; patches available for CVE-2026-104935
Summary
Ivanti says CVE-2026-104935, an unauthenticated command-execution flaw in Connect Secure, was exploited before disclosure. Updates are available for affected versions; organizations should patch urgently and check for compromise.
Key points
- CVE-2026-104935 is a high-severity authentication-bypass vulnerability (CVSS 8.6) that lets remote unauthenticated attackers execute commands on affected Ivanti Connect Secure systems.
- Ivanti and CISA confirmed exploitation before public disclosure, affecting a limited number of customers; CISA added the flaw to its Known Exploited Vulnerabilities catalog.
- Affected versions include 25.1.1.1 and earlier, 25.1.2.2 and earlier, and 22.8R2.4 and earlier in the applicable code lines. Ivanti lists fixes in versions 25.1.1.2, 25.1.3.0/25.1.3.1, and 22.8R2.5, respectively.
- Ivanti says versions 22.7.x and below are unaffected.
- Rapid7 recommends emergency patching and checking for signs of compromise even after updating; follow Ivanti's recovery steps if exploitation is suspected.
- Volexity reported that the actor also used a separate, as-yet-unpatched privilege-escalation vulnerability.
Article Details
- Vulnerability Types
- Authentication bypass by spoofing
- Remote arbitrary command execution
- Severity
- High; CVSSv3.0 8.6
- Affected Versions
- Ivanti Connect Secure 25.1.1.1 and prior in the applicable code line
- Ivanti Connect Secure 25.1.2.2 and prior in the applicable code line
- Ivanti Connect Secure 22.8R2.4 and prior in the applicable code line
- Exploitation Status
- active
- Exploit Availability
- unknown
- Patch Status
- available