Ivanti Connect Secure CVE-2026-104935 Flaw Enables Unauthenticated Remote Code Execution

Ivanti released security updates for Ivanti Connect Secure (ICS) to address CVE-2026-104935, a high-severity authentication-bypass vulnerability. This vulnerability allows remote, unauthenticated attackers to execute arbitrary commands.

The company disclosed the issue on October 13, 2026. It confirmed that exploitation had affected a limited number of customers at the time of disclosure.

Fixed software versions are now available, making remediation an immediate priority for organizations operating affected appliances.

Ivanti Connect Secure Flaw

This vulnerability carries a CVSS v3.0 score of 8.6 and is classified as CWE-290, which refers to authentication bypass by spoofing. The advisory states that successful exploitation requires no valid credentials or user interaction.

Its network-accessible attack vector and low attack complexity make the flaw particularly significant for exposed deployments. The disclosed impacts include a high loss of confidentiality, with lower impacts on integrity and availability.

Ivanti describes the issue as an authentication bypass affecting ICS versions earlier than 25.1.3.0, which enables arbitrary command execution.

However, administrators should refer to the advisory’s branch-specific release mappings rather than treating that version as the only one requiring remediation.

Ivanti explicitly states that ICS version 22.7R2.14 and earlier are not impacted, distinguishing those releases from the affected branches mentioned in its update guidance.

The affected versions include ICS 25.1.1.1 and earlier, 25.1.2.2 and earlier, and 22.8R2.4 and earlier. The corresponding resolved releases are 25.1.1.2; 25.1.3.0 and 25.1.3.1; and 22.8R2.5.

These distinctions matter when determining the right upgrade path: organizations should match their deployed branch against the listed fixed versions rather than assume every older ICS release has the same exposure.

Ivanti’s confirmation of exploitation indicates this vulnerability poses an operational threat rather than a purely theoretical one. However, the advisory does not identify the attackers, affected organizations, the exploitation timeline, or the commands executed during observed incidents.

It also does not provide indicators of compromise or describe the specific spoofing mechanism. These omissions limit conclusions about attacker objectives, campaign scale, and post-exploitation activities.

An update on October 13 noted that a Volexity blog post was added to the advisory’s frequently asked questions. The supplied material does not include details from that investigation, so we cannot independently characterize its findings.

Additionally, the advisory’s acknowledgment of limited customer impact should not be interpreted as evidence that other vulnerable deployments are safe, nor that exploitation is confined to a specific environment.

Ivanti urges customers to resolve the vulnerability by upgrading to a listed fixed release. Downloads are available through the Ivanti License System. Administrators should prioritize affected installations and verify their running versions against the advisory’s release table.

The provided guidance specifies software updates as the resolution and does not document any workarounds. Because exploitation occurred before disclosure, installing a fix should not be treated as proof that an appliance was never compromised.

Update defenses against new malware as soon as it appears. Integrate TI Feeds with data from 16K SOCs.