Ivanti Connect Secure: CVE-2026-104935 Under Active Attack

What CVE-2026-104935 is and who is affected

Ivanti Connect Secure, the remote-access VPN appliance that many organisations place directly on the internet, carries a serious authentication bypass. The flaw is tracked as CVE-2026-104935 and officially named the Ivanti Connect Secure Authentication Bypass by Spoofing Vulnerability. It is classified as CWE-290 (authentication bypass by spoofing) and rated CVSS 3.1 8.6, HIGH, with the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L.

According to the National Vulnerability Database (NVD) at NIST, an authentication bypass by spoofing in ICS before version 25.1.3.0 allows a remote unauthenticated attacker to execute arbitrary commands. In plain terms: no credentials, no user interaction and no local access are needed. The same NVD entry states that ICS version 22.7R2.14 or prior is not impacted.

The affected versions listed by NVD are:

• ivanti connect_secure from 25.1.0.0 (inclusive) up to 25.1.1.2 (exclusive)
• ivanti connect_secure from 25.1.2.0 (inclusive) up to 25.1.3.0 (exclusive)
• ivanti connect_secure 22.8 r2
• ivanti connect_secure 22.8 r2.1
• ivanti connect_secure 22.8 r2.2
• ivanti connect_secure 22.8 r2.3
• ivanti connect_secure 22.8 r2.4

This matters to Spanish SMEs, online shops and internal IT teams that rely on a VPN concentrator for remote work, supplier access or branch connectivity. If your appliance sits on a public IP address, it is reachable by anyone who knows the address.

Why it is urgent: it is already being exploited

This is not a theoretical risk. CISA added CVE-2026-104935 to its Known Exploited Vulnerabilities (KEV) catalogue on 13 October 2026, which means there is evidence of exploitation in real attacks. The NVD publication date matches: 13 October 2026.

Because of that KEV listing, CISA gave US federal agencies a remediation deadline of 16 October 2026 — only three days. The required action is to apply mitigations in accordance with vendor instructions, following CISA's BOD 26-04 guidance on prioritising security updates based on risk and its Forensics Triage Requirements, or to discontinue use of the product if mitigations are unavailable. CISA also reminds asset owners to evaluate each asset's internet exposure.

The reference material does not record this CVE as used in ransomware campaigns, so we will not claim that it is. The absence of a ransomware link does not make it less dangerous: an unauthenticated command execution path on an internet-facing VPN is exactly the kind of foothold that is later sold or reused.

What to do today

• Inventory first. Confirm whether Ivanti Connect Secure is deployed, in which version, and whether it is exposed to the internet. Check the exact build against the affected list above, including the 22.8 r2.x line.
• Apply the vendor's fix or mitigation. Follow the official Ivanti security advisory for CVE-2026-104935. The reference material does not state which build resolves the issue beyond the NVD note that versions before 25.1.3.0 are affected, so use whatever update or mitigation the vendor advisory specifies rather than assuming a version number.
• Look for signs of intrusion. Treat any unpatched, internet-facing appliance as potentially compromised. Review authentication and administrative logs, unexpected configuration changes, new local accounts and outbound connections from the appliance, and follow the forensics triage approach CISA requires.
• Reduce exposure. Where the appliance does not need to be publicly reachable, restrict access by IP allow-list, place it behind additional controls, and disable unnecessary administrative interfaces. Every service you remove from the public internet is one fewer entry point.
• Patch on a schedule, not on a headline. KEV entries with three-day deadlines show how little time there is between disclosure and exploitation. A predictable patching rhythm for WordPress, PrestaShop, Joomla, servers and network appliances closes that gap before it becomes an incident.

How a cybersecurity team such as ALMC's can help

For a small IT team in Lleida, Barcelona, Tarragona or Girona, keeping up with advisories like this one is a second job. Our cybersecurity work for businesses starts with finding out what you actually have exposed: security audits and pentesting, hardening of servers and web platforms, and monitoring with incident response when something looks wrong. We also handle the day-to-day maintenance and updating of WordPress, PrestaShop and Joomla, and we repair websites that have already been hacked.

The point is not to react to every CVE headline, but to know which assets matter, keep them patched in line with vendor advisories, and have someone watching the logs when a vulnerability like CVE-2026-104935 moves from a warning to an active attack. Sources: CISA Known Exploited Vulnerabilities catalogue and the NIST National Vulnerability Database.

Related

• Abuse Shield

Is your business exposed to flaws like this?

ALMC checks which versions you are running, applies the patches and hardens your servers and website. Contact our team for a security review.