Ivanti Connect Secure CVE-2026-104935: Patch Now, CISA Says

CISA added CVE-2026-104935, an authentication-bypass-by-spoofing flaw in Ivanti Connect Secure, to its Known Exploited Vulnerabilities (KEV) catalog on October 13, 2026, confirming active exploitation in the wild. The bug, tracked under CWE-290, lets a remote, unauthenticated attacker spoof past Connect Secure's login and execute arbitrary commands on the appliance. Because CISA classified the flaw as publicly exposed, automatable, and capable of giving an attacker total control — the four conditions that trigger the fastest tier under Binding Operational Directive (BOD) 26-04 — federal civilian agencies have until October 16, 2026 to apply mitigations or pull the product offline. That's a three-day clock, one of the tightest remediation windows the directive allows, and it's a strong signal to every organization running Connect Secure, not just federal agencies, that this needs attention now.

What happened: CVE-2026-104935 explained

CISA's KEV catalog entry describes CVE-2026-104935 in blunt terms: "Ivanti Connect Secure contains an authentication bypass by spoofing vulnerability that allows a remote unauthenticated attacker to execute arbitrary commands." The National Vulnerability Database entry is more specific about the mechanics, noting that the "authentication bypass by spoofing in ICS before version 25.1.3.0 allows a remote unauthenticated attacker to execute arbitrary commands," and that the issue "does not impact ICS version 22.7R2.14 or prior."

In practice, that means an attacker doesn't need a valid username, password, multi-factor token, or any other credential to get in. The flaw lets them spoof whatever the appliance checks to establish trust — CISA's classification under CWE-290 ("Authentication Bypass by Spoofing") — and ride that straight through to command execution on the underlying system. There's no social-engineering step, no phishing email, no credential theft required. The attacker just needs network reachability to the appliance's management or authentication interface.

That combination — unauthenticated, remote, and leading directly to arbitrary command execution — is about as bad as a vulnerability class gets for an edge device. It's also precisely the pattern Ivanti's Connect Secure line has seen before: Ivanti's gateway and VPN products have been a recurring target for both opportunistic and state-linked intrusion sets, in part because of exactly this kind of flaw, and in part because of what the product sits in front of.

Why an internet-facing VPN gateway being exploitable like this is serious

Ivanti Connect Secure is not a niche product. It's a widely deployed SSL VPN and remote-access gateway that sits at the perimeter of enterprise networks, government agencies, healthcare systems, and critical infrastructure operators, authenticating remote employees and brokering their access to internal resources. By design, it has to be reachable from the public internet for remote work to function — which also means it is, by design, exposed to anyone who wants to probe it.

An authentication-bypass flaw on a device like this is a worst-case scenario for exactly that reason. The appliance is the trust boundary between the open internet and the internal network. Compromise it, and an attacker doesn't just get into one device — they get a foothold inside the perimeter, often with a direct line to internal directory services, VPN session data, and whatever else the gateway can see on the LAN side. Arbitrary command execution on that box can mean credential harvesting, lateral movement staging, persistence mechanisms planted before a patch is even applied, or simply a beachhead that's sold on to a ransomware affiliate later. For background on what that kind of unauthenticated bypass can feed into downstream, see our explainer on credential stuffing and how attackers monetize stolen access.

It's also a familiar storyline. CISA and the security community have repeatedly flagged Ivanti's edge products — Connect Secure and its sibling Policy Secure — as high-value targets precisely because of their perimeter position and their track record of exploited authentication and command-injection flaws in recent years. Every time a new one lands in the KEV catalog, it reinforces the same operational lesson: organizations that run these gateways need a faster patch cycle for them than for ordinary internal software, because the exposure window is a live attack surface, not a theoretical one.

How severe is it? The CVSS 8.6 score, explained

NVD's analysis assigns CVE-2026-104935 a CVSS 3.1 base score of 8.6 (High), with the vector string AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L. Breaking that down: the attack vector is network-based (AV:N), attack complexity is low (AC:L), no privileges are required (PR:N), and no user interaction is needed (UI:N) — meaning any remote attacker who can reach the login path can attempt exploitation without help from a victim. The impact side shows high confidentiality impact (C:H), with lower integrity and availability impacts (I:L, A:L), reflecting that the primary outcome is unauthorized access and command execution rather than, say, a straightforward denial-of-service.

CISA's own vulnerability-management scoring (SSVC) data submitted alongside the KEV addition goes further, classifying the flaw's exploitation status as "active," its exploitability as "automatable," and its technical impact as "total" — the three findings that, combined with the appliance's internet exposure, are what triggers BOD 26-04's shortest remediation tier. A High CVSS score alone wouldn't necessarily land a vulnerability in the fastest bucket under the new directive; it's the combination of real-world exploitation, scriptability, and full-control impact that does.

Who's affected: versions and the patched releases

Per NVD's configuration data for this CVE, the vulnerable releases fall into two branches of Connect Secure: the 25.1.x line between 25.1.0.0 and just before 25.1.1.2, and again between 25.1.2.0 and just before 25.1.3.0; and the entire 22.8R2 through 22.8R2.4 range. Ivanti has shipped fixes on both affected branches — 25.1.3.0 (and the subsequent 25.1.3.1) resolves it on the newer line, while 22.8R2.5 resolves it on the 22.8R2.x line. Notably, the older 22.7R2.x branch, up to and including 22.7R2.14, is explicitly called out as unaffected by this particular flaw, so administrators running that older branch aren't on the hook for this specific CVE — though it's worth confirming against Ivanti's own advisory, since a device running an outdated branch for other reasons may carry separate, unrelated exposure.

The practical takeaway for IT and security teams: check your Connect Secure version against the exact build numbers above, not just the major release line. A box running 25.1.2.3, for instance, is still vulnerable even though it's on the "patched" 25.1.x line in general terms — only 25.1.3.0 and later actually contain the fix.

What CISA's KEV catalog addition actually means in practice

The Known Exploited Vulnerabilities catalog exists for one purpose: to list CVEs that CISA has confirmed are being actively exploited, not just theoretically exploitable. Addition to the catalog is CISA's way of telling the entire ecosystem — federal agencies, state and local governments, critical infrastructure operators, and the private sector — that this isn't a "patch when convenient" item anymore.

For federal civilian executive branch (FCEB) agencies, a KEV addition carries binding force under BOD 26-04, "Prioritizing Security Updates Based on Risk," which CISA issued in mid-2026 to replace the older BOD 22-01 patch-timeline directive. BOD 26-04 scores every KEV-listed vulnerability against four factors: whether the affected asset is exposed to the public internet, whether exploitation can be automated, and whether successful exploitation grants partial or total control of the system. Vulnerabilities that check all those boxes — as CVE-2026-104935 does — land in the directive's fastest remediation tier: three days from the KEV addition date. That's why the due date on this entry is October 16, 2026, just three days after it was added on October 13.

That three-day window is unusually tight even by KEV standards; most catalog entries carry a standard 14-day or longer remediation deadline unless they meet BOD 26-04's strictest criteria. It reflects how seriously CISA is treating an unauthenticated, remotely exploitable, fully-compromising bug on a perimeter VPN appliance that is actively being attacked. The KEV entry also flags forensicTriage: Yes, which ties into CISA's companion "Forensics Triage Requirements" guidance: agencies aren't just expected to patch, they're expected to check first for signs of prior compromise and preserve forensic evidence before or while remediating, on the theory that an authentication-bypass flaw this severe may already have been used against a given appliance before the patch was applied.

If an agency can't apply Ivanti's mitigation within that window, BOD 26-04 requires it to follow CISA's cloud-services guidance or, failing that, discontinue use of the product entirely until it's remediated. That's a notably harder line than "patch when you can" — it explicitly puts taking the appliance offline on the table as a required fallback, not just a suggestion.

Private-sector organizations, state and local governments, and enterprises outside the federal civilian branch aren't legally bound by BOD 26-04. But CISA's KEV catalog is widely treated as the de facto minimum bar for "known, actively exploited, fix it now" across the security industry, and insurers, auditors, and incident-response firms increasingly reference KEV status when assessing an organization's patch posture after an incident. Running an unpatched, KEV-listed, internet-facing VPN gateway past its due date is a hard position to defend after the fact, directive or not.

Is this tied to ransomware? What "Unknown" actually means

CISA's KEV entry lists knownRansomwareCampaignUse as "Unknown" for CVE-2026-104935. That field is specifically reserved for cases where CISA has confirmed the vulnerability has been used in a named ransomware campaign — and right now, it hasn't made that link for this CVE. That's a meaningful distinction: CISA has confirmed active exploitation (that's why the CVE is in the KEV catalog at all), but it has not confirmed that exploitation is tied to ransomware specifically. Treat any claim that this flaw is "being used in ransomware attacks" as unsupported until CISA's own data says otherwise — the confirmed fact here is exploitation in the wild, not a ransomware campaign.

That said, "unknown" is not the same as "ruled out," and authentication-bypass flaws on internet-facing appliances are a well-established initial-access vector that ransomware affiliates buy, sell, and exploit on exactly this kind of timeline. Security teams shouldn't wait for a ransomware-campaign confirmation to treat this as urgent.

What Ivanti's advisory says to do

Ivanti has published its own security advisory for CVE-2026-104935, referenced directly in CISA's KEV notes field and cross-indexed by NVD as the vulnerability's vendor advisory. In line with how Ivanti has handled prior Connect Secure authentication and command-execution flaws, the core guidance is to move affected appliances onto the fixed release for their branch — 25.1.3.0 or later for the 25.1.x line, or 22.8R2.5 for the 22.8R2.x line — as the primary remediation. Organizations that cannot immediately upgrade should consult Ivanti's advisory directly for any interim mitigation steps and should not treat a delayed patch as an acceptable long-term posture given the confirmed active exploitation.

Administrators should also review Ivanti's advisory for guidance on checking appliances for indicators of prior compromise, consistent with CISA's forensic-triage expectation for this entry — patching alone doesn't undo any access an attacker may have already gained through the bypass before the fix was applied.

How to patch: upgrade steps

1. Inventory every Connect Secure appliance in your environment and record its exact build number, not just the major version line.
2. Cross-check each build against the vulnerable ranges above: 25.1.0.0–25.1.1.1, 25.1.2.0–25.1.2.x, and 22.8R2 through 22.8R2.4.
3. Upgrade to the fixed release for your branch — 25.1.3.0 or newer, or 22.8R2.5 — following Ivanti's documented upgrade path for your current version.
4. Before and during the upgrade, triage for compromise: review authentication logs, admin-session activity, and configuration changes for anything that predates your patch window, per Ivanti's advisory and CISA's forensic-triage expectation.
5. If you cannot patch within CISA's window, evaluate whether the appliance can be taken offline or isolated from the public internet until the fix is applied, rather than leaving it exposed and unpatched.
6. Re-verify exposure after patching: confirm the management interface isn't unnecessarily internet-facing, and that remote-access policies align with least-privilege principles going forward.

This advisory arrives not long after a similarly urgent KEV addition for another remote-access vendor — see our coverage of the SonicWall SMA1000 SSRF flaw that also demanded immediate patching — underscoring that perimeter VPN and remote-access appliances remain one of the most consistently targeted categories of enterprise hardware.

What to do now

• Identify every Connect Secure instance you operate or manage on behalf of a client, and pull its exact version/build number today.
• Patch to 25.1.3.0+ or 22.8R2.5 depending on your branch, treating this as a same-week (not same-quarter) priority regardless of whether you're bound by BOD 26-04.
• Don't assume you're in the clear just because exploitation isn't yet confirmed as ransomware-linked — CISA has confirmed active exploitation, which is the operative fact here.
• Preserve logs before remediating where possible, in case forensic review is later needed to determine whether a given appliance was already accessed.
• Subscribe to Ivanti's and CISA's advisory feeds for this product line, since Connect Secure has a recurring history of KEV-listed flaws and further updates are plausible.
• Reassess your perimeter exposure generally — if command execution via appliance compromise is a live concern, make sure endpoint and network monitoring can catch the malware or tooling an attacker might stage post-exploitation; our guide on malware types, warning signs, and removal covers what to watch for downstream of an initial-access event like this one.

Written bySana Qureshi

Sana Qureshi runs the security and privacy desk. She reports on actively exploited vulnerabilities, vendor patches and data breaches, and covers the password managers, VPNs and authentication tools readers use to protect themselves. Her alerts cite vendor advisories, CISA and the CVE record directly.

More from Sana QureshiAll Security & Privacy coverage