IVANTI Connect Secure has a high‑severity zero‑day, CVE-2026-104935, described by Ivanti as an unauthenticated authentication bypass (CWE-290) that allows remote command execution. The vulnerability, rated CVSSv3.0 8.6, affects Ivanti Connect Secure appliances and was exploited in the wild prior to public disclosure. CISA has added CVE-2026-104935 to its Known Exploited Vulnerabilities catalog on the same day Ivanti issued its advisory.
Rapid7 notes that exploitation began in the wild before the fix was available, with a threat actor chain described by Volexity as including the zero‑day and a separate privilege‑escalation vulnerability that Ivanti plans to patch later. Ivanti reports that part of the flaw was identified through its security programme and was patched in the July 2026 release of 25.1.3[.]0, but exploitation continued as teams worked to backport the fix to other supported versions.
Mitigation guidance from Ivanti provides updated fixes for affected versions, with concrete resolved versions including 25.1.1[.]2, 25.1.3[.]0 and 25.1.3[.]1, and 22.8R2.5 (while 22.7.x and below are unaffected). Ivanti cautions that reliable indicators of compromise were not available at the time of the advisory, though Volexity has published indicators in its threat intel.
Rapid7 urges organisations running affected versions to apply the emergency update outside normal patch windows and to look for signs of compromise even after patching, following Ivanti’s recovery steps. For precise guidance, refer to Ivanti’s security advisory and backport status messages. Rapid7 notes that vulnerability checks for exposure will be available in the October 14 content release for Exposure Command, Vulnerability Management, and Nexpose customers.