Zero-day vulnerability in Ivanti Connect Secure
On 13 October 2026, Ivanti released security updates for a zero-day vulnerability in Ivanti Connect Secure. According to Ivanti, the vulnerability has already been exploited at a limited number of customer sites.
T-Update
This live blog contains information regarding a zero-day vulnerability in Ivanti Connect Secure. Active exploitation has been observed.
Blog last updated on 13 October
Update 13 October 2026
On 13 October 2026, Ivanti released security updates for a zero-day vulnerability in Ivanti Connect Secure. According to Ivanti, the vulnerability, CVE-2026-104935, has already been exploited at a limited number of customer sites.
Ivanti has released security updates to address this vulnerability. Malicious actors can exploit the vulnerability without authentication to execute arbitrary commands on vulnerable systems.
Background
Ivanti Connect Secure is a VPN solution that allows employees to access their organisation's systems and applications via a secure connection. On 13 October 2026, Ivanti released a security update for CVE-2026-104935. The NCSC has classified the vulnerability as an authentication bypass by spoofing. An attacker can exploit this remotely without logging in, allowing them to execute arbitrary commands on the system.
Risk
Ivanti reports that the vulnerability was already being exploited before it was made public. There is no public Proof-of-Concept available yet. However, the NCSC expects one to appear in the short term, which increases the risk of large-scale exploitation. Ivanti has assigned the vulnerability a CVSS score of 8.6. The NCSC assesses both the likelihood of exploitation and the potential damage as high.
The vulnerability applies to the following versions:
- Ivanti Connect Secure 22.8R2.4 and older within the 22.8 series
- Ivanti Connect Secure 25.1.1.1 and older within this version series
- Ivanti Connect Secure 25.1.2.2 and older within this version series
According to Ivanti, version 22.7R2.14 and older are not affected.
Successful exploitation can lead to:
- Full takeover of the device;
- Execution of arbitrary commands;
- Access to underlying systems and data.
Advice
Ivanti strongly advises customers to install the following versions, which address the vulnerability:
- 22.8 series: preferably upgrade to 25.1.1.2 or newer. If that is not yet possible, 22.8R2.5 also resolves the vulnerability
- 25.1.1.x: 25.1.1.2
- 25.1.2.x: 25.1.3.0 or 25.1.3.1
Please note: updating alone does not undo a previous breach. If you suspect your system has already been compromised, please also follow Ivanti's recovery steps.
Additional measures
- Check systems for signs of compromise using Ivanti's Integrity Checker Tool (ICT).
- Restrict access to the Ivanti Connect Secure management interface to trusted IP addresses.
- Actively monitor for suspicious login attempts, unexpected network connections, and configuration changes.
If you suspect your system has been compromised based on Ivanti's Integrity Checker Tool (ICT), or if you are unsure, please contact our T-CERT for further advice.
Sign up for T-Updates
Receive the latest news about malware or vulnerabilities in your inbox every Wednesday
More than 1,000 organizations have already joined us.
