Introduction

The National Cyber Security Agency (NACSA), through the National Cyber Coordination and Command Centre (NC4), highlights high-severity authentication bypass vulnerability, identified as CVE-2026-104935 (CVSS 8.6), has been disclosed in Ivanti Connect Secure (ICS). The vulnerability allows unauthenticated remote attackers to execute arbitrary commands on affected systems.

The Cybersecurity and Infrastructure Security Agency (CISA) has confirmed active exploitation and added the vulnerability to its Known Exploited Vulnerabilities (KEV) catalogue on 13 October 2026. 

Impact

Successful exploitation may allow attackers to:

• Execute arbitrary commands without authentication.
• Steal credentials and sensitive information.
• Exfiltrate data from compromised systems.
• Potentially compromise connected enterprise environments.

CISA has reported exploitation involving credential theft and data exfiltration.

System Affected

The following Ivanti Connect Secure versions are affected:

• 25.1.1.1 and earlier within the affected 25.1.1 release branch.
• 25.1.2.2 and earlier within the affected 25.1.2 release branch.
• 22.8R2.4 and earlier within the affected 22.8 release branch.

Note: Ivanti confirms that version 22.7R2.14 and earlier in the 22.7 branch are not affected by this vulnerability.

Recommendation

How to check

1. Identify deployed Ivanti Connect Secure appliances and verify their firmware versions.
2. Review VPN authentication, administrator and network logs for suspicious activities.
3. Run the Ivanti Integrity Checker Tool (ICT) to identify potential compromise.
4. Conduct network and memory forensic analysis where exploitation is suspected.

Note: A clean ICT result does not rule out exploitation, as malicious commands may execute in memory.

Recommended actions

1. Immediately update affected appliances to the appropriate vendor-fixed versions, such as 25.1.1.2, 25.1.3.0 or later, or 22.8R2.5 for the corresponding release branch.
2. Investigate affected systems for potential compromise and preserve relevant evidence.
3. Restrict unnecessary access and strengthen VPN security monitoring.
4. If compromise is suspected, follow Ivanti recovery procedures, including factory reset or rebuilding affected appliances and applying security updates.

Reset affected account credentials, revoke and reissue relevant certificates, and rotate stored API keys where compromise is suspected.

References

Ivanti – Security Advisory: Ivanti Connect Secure (CVE-2026-104935)    https://hub.ivanti.com/s/article/Security-Advisory-Ivanti-Connect-Secure-CVE-2026-104935

CISA – CISA Urges Patching Newly Exploited Vulnerability in Ivanti Connect Secure (13 October 2026)    https://www.cisa.gov/news-events/alerts/2026/10/13/cisa-urges-patching-newly-exploited-vulnerability-ivanti-connect-secure

NIST National Vulnerability Database – CVE-2026-104935    https://nvd.nist.gov/vuln/detail/CVE-2026-104935