Ivanti disclosed CVE-2026-104935 on 13 October 2026 and said a limited number of customers were already exploited. The flaw is an authentication bypass by spoofing in Ivanti Connect Secure, scored 8.6. A remote attacker with no account and no user interaction can run arbitrary commands on the gateway.
What happened
Volexity reported the bug. Ivanti published fixes the same day and told customers to upgrade immediately and run the Integrity Checker Tool. CISA added CVE-2026-104935 to the Known Exploited Vulnerabilities catalog on 13 October, with a federal due date of 16 October 2026.
Connect Secure is the SSL VPN formerly known as Pulse Connect Secure. Internet-facing appliances of this family have been a repeated initial-access path. Shadowserver was tracking more than 5,500 exposed ICS instances when the advisory landed. That count mixes live targets and honeypots, so it is exposure, not a victim count.
Who is affected
Ivanti lists three affected branches. Version 22.7R2.14 and earlier is not affected.
- 22.8R2.4 and earlier, fixed in 22.8R2.5
- 25.1.1.1 and earlier, fixed in 25.1.1.2
- 25.1.2.2 and earlier, fixed in 25.1.3.0 or 25.1.3.1
What to do now
Upgrade every internet-facing Connect Secure appliance to a fixed build today, then run the Integrity Checker Tool and treat any integrity failure as a compromise. Pull the gateway off the internet if you cannot patch this week. Review admin logins, new local accounts, and unexpected config changes since before 13 October.
Source: BleepingComputer, Ivanti Connect Secure zero-day. Vendor advisory: Ivanti security advisory.
Also on the blog
- GitLab CVE-2026-97229: CVSS 10.0 unauthenticated RCE
- SAP Cloud SDK CVE-2026-89111 CVSS 10 OAuth2 SSRF
- AhsayCBS CVE-2026-105134: SYSTEM RCE, 5 organizations hit
- LG webOS local-network root chain, no PIN required
Next step: If this is on your network or a client's, ask Matthews Enterprises to check exposure.