Ivanti Connect Secure zero-day lets attackers run commands unauthenticated

Ivanti Connect Secure zero-day lets attackers run commands unauthenticated

13 October 2026: Ivanti has disclosed CVE-2026-104935, an authentication bypass in Connect Secure, its SSL VPN gateway, that lets a remote attacker with no account run arbitrary commands on the appliance, and says it already knows of "limited exploitation in the wild". The CVE record Ivanti filed scores it 8.6 (high) and names the builds that are not affected, so the fix is an upgrade.

Not yet independently verified. Ivanti's own advisory page renders only in a browser and could not be read; the versions and the CVSS score come from the CVE record Ivanti filed, and the exploitation statement from its blog. Ivanti has not said how many customers were hit. We will update this when it can be confirmed, and remove this note.

CISA added the flaw to its Known Exploited Vulnerabilities catalogue within an hour of Ivanti's post and gave US federal civilian agencies until 16 October to act, one of the shortest deadlines it sets. The Dutch national cyber centre rated it high for both likelihood and damage and said it expects public exploit code soon.

Which builds are affected

The CVE record describes the flaw as affecting Connect Secure "before version 25.1.3.0" and says it "does not impact ICS version 22.7R2.14 or prior". It lists four versions as unaffected:

• 25.1.3.0 and 25.1.3.1 on the current 25.x line
• 22.8R2.5 on the 22.8 line
• 22.7R2.14, along with every earlier 22.7 release

In practice the exposed estate is anything on the 22.8 line before R2.5 and anything on 25.x before 25.1.3.0. Organisations that stayed on 22.7R2.14 or older are outside this CVE, although the 22.7 line carries older Ivanti flaws of its own and is not a place to stay.

The weakness is classed as authentication bypass by spoofing (CWE-290). The CVSS vector rates it network-reachable, low complexity, needing no privileges and no user action, with a high impact on confidentiality and a low impact on integrity and availability. CISA's short description is blunter: an unauthenticated attacker can execute arbitrary commands.

What Ivanti asks customers to do

Ivanti's blog tells customers to upgrade to the fixed version and to run its Integrity Checker Tool regularly. That second instruction matters more than usual here. Connect Secure sits on the network edge, and earlier Ivanti gateway flaws in 2024 and 2025 were used to plant persistence that survived upgrades. A gateway that was exposed on a vulnerable build before the patch went on should be checked, not just updated.

CISA's required action goes further for US agencies: apply the vendor's mitigations under its binding operational directive, follow its forensic triage requirements, and stop using the product if mitigations are not available. Private companies are not bound by that deadline, but the 72-hour window says how CISA judges the risk.

The same Ivanti post covers its regular October patch release for Ivanti Neurons Patch for Intune and Xtraction, for which Ivanti reports no known exploitation.

How exposed buyers are

Connect Secure, sold for years as Pulse Connect Secure, is one of the most widely deployed enterprise VPN gateways, and it has been a repeated target: CISA has listed several Connect Secure flaws as exploited since 2021. Teams that cannot upgrade within days should at least restrict which networks can reach the appliance's web interface and watch its logs for sessions that never passed an authentication step.

Ivanti in our catalogue

We list Ivanti as a company, and our VPN software category lists 13 products, including the business remote-access clients Cisco AnyConnect, FortiClient and OpenVPN Access Server.

Sources

• Ivanti: October 2026 Security Update (blog), 13 October 2026
• CVE record CVE-2026-104935 (published by Ivanti as CNA), 13 October 2026
• CISA: Known Exploited Vulnerabilities catalogue, version 2026.10.13, 13 October 2026
• NCSC-NL: advisory NCSC-2026-0416, 13 October 2026