Critical Ivanti Connect Secure vulnerability: CVE-2026-104935 #
Ivanti disclosed certain versions of Ivanti Connect Secure are affected by an authentication bypass by spoofing vulnerability. A remote, unauthenticated attacker can exploit it to execute arbitrary commands on the appliance. The vulnerability has been designated CVE-2026-104935 and has been rated high with a CVSS score of 8.6.
Evidence indicates that this vulnerability is actively exploited in the wild, leading to its addition to the CISA Known Exploited Vulnerabilities (KEV) catalog on October 13, 2026.
The following versions are affected
- Ivanti Connect Secure 25.1: Versions 25.1.1.1 and prior, and versions 25.1.2.2 and prior
- Ivanti Connect Secure 22.8: Versions 22.8R2.4 and prior
Ivanti Connect Secure 22.7R2.14 and prior, and 25.1.3.0 and later, are not affected.
What is Ivanti Connect Secure (ICS)? #
Ivanti Connect Secure (ICS) (formerly Pulse Connect Secure) is a secure remote access and virtual private network (VPN) solution.
What is the impact? #
Successful exploitation of this vulnerability would allow a remote, unauthenticated attacker to bypass authentication and execute arbitrary commands on the affected appliance, resulting in complete device compromise and unauthorized control of the secure remote access environment.
Are updates or workarounds available? #
Users are encouraged to update to the latest version as quickly as possible:
- Ivanti Connect Secure 25.1: Upgrade to version 25.1.1.2 (ISA6000 or ISA8000) or 25.1.3.0 or later (ISA4500, ISA6500, or ISA8500).
- Ivanti Connect Secure 22.8: Upgrade to version 22.8R2.5, or preferably migrate to 25.1.1.2 or later.
Note: Ivanti Connect Secure 22.7 and 22.8 reach end of life on January 31, 2027; plan to transition to the 25.1 line before that date. Migrating to 25.1.3.0 requires the new ISA4500, ISA6500, or ISA8500 platform, or new virtual or cloud devices built from the 25.1.3.0 template. Run the Integrity Checker Tool regularly and review the indicators of compromise published by Volexity.
Finding exposed Ivanti Connect Secure appliances with runZero #
From the Software Inventory, use the following query to locate potentially impacted assets:
vendor:="Ivanti" AND product:="Connect Secure"
