IVANTI Connect Secure has a newly disclosed vulnerability, CVE-2026-104935, which Ivanti confirms is being exploited in the wild. The flaw allows a remote, unauthenticated attacker to bypass authentication by spoofing and then execute arbitrary commands on the appliance, effectively giving an attacker a foothold inside the targeted network. Ivanti assigns a CVSS v3.1 score of 8.6 (High) for this issue, and the advisory notes exploitation was occurring among a limited number of customers at the time of disclosure.
Affected versions include Ivanti Connect Secure 25.1.1[.]1 and earlier (fixed in 25.1.1[.]2), 25.1.2[.]2 and earlier (fixed in 25.1.3[.]0 and 25.1.3[.]1), and 22.8R2.4 and earlier (fixed in 22.8R2.5). Ivanti states the flaw does not impact ICS versions 22.7R2.14 or earlier. The recommended mitigations are to upgrade on the 22.8.x line to 25.1.1[.]2 or later (or, if unavailable, apply 22.8R2.5); on the 25.1.1[.]1 branch, move to 25.1.1[.]2 (ISA6000 or ISA8000).
Organisations should plan to move off 22.7 and 22.8 ahead of their end-of-life date on 31 January 2027, and review logs for signs of compromise given active exploitation. Ivanti also urges customers to stay current by upgrading to the latest version to benefit from security improvements. The advisory credits Volexity for assistance in the investigation, noting their prior work on Connect Secure zero-days exploited earlier in 2024.