BREAKING: Ivanti Connect Secure login bypass is being exploited, now on CISA KEV (CVE-2026-104935)

Attackers are already using a login bypass in Ivanti Connect Secure to run commands on the VPN appliance, with no account needed. Ivanti disclosed CVE-2026-104935 on 2026-10-13 and says it is "aware of exploitation in the wild affecting a limited number of customers at the time of disclosure." CISA added it to the Known Exploited Vulnerabilities catalog the same day with a due date of 2026-10-16, three days out. If you run Connect Secure on 22.8 or 25.1, patch today.

This post is our operator read of Ivanti's security advisory and the CISA KEV entry. The HOL Guard evidence pack for CVE-2026-104935 is the source record.

How to fix

Install the resolved build for the line you are on. Ivanti lists no workaround; upgrading is the only fix. Packages are in the Ivanti License System (ILS).

Two dates in the advisory are worth reading twice. 25.1.1.2 shipped on October 5 and 22.8R2.5 on October 12. If someone on your team already rolled 25.1.1.2 last week, you are on a fixed build and the remaining work is checking whether anyone got in before that.

The 25.1.3.x path is not a quick hop. Ivanti says 25.1.3.0 needs the new ISA4500, ISA6500 or ISA8500 hardware, and virtual or cloud appliances have to be rebuilt from the 25.1.3.0 template. If you are on ISA6000 or ISA8000 today, 25.1.1.2 is the patch you can install this afternoon.

Why a July fix did not protect most people

The FAQ has the detail that matters most. Ivanti found "a portion of this vulnerability" itself and fixed it in 25.1.3.0 in July. It was still backporting that fix to the older supported lines when attackers started using it.

So for about three months, a fix sat in a release that most of the installed base could not take without new hardware or a rebuilt appliance. That gap is the risk pattern to plan for with any edge device whose newest release depends on a hardware refresh: the vendor can say "fixed" while your box stays exposed. If your VPN upgrade plan is "when the new appliances arrive," budget for patches like this landing on the old line first.

Who is not in scope

• Connect Secure 22.7.x and lower. Ivanti says plainly that 22.7R2.14 and earlier do not contain the bug. Do not jump from 22.7 to an unpatched 22.8 build to "get current." 22.7 and 22.8 both reach end of life on January 31, 2027, so the 25.1 migration still has to happen.
• 25.1.3.0 and later on ISA4500, ISA6500 or ISA8500. Those builds already carry the fix.
• Ivanti Policy Secure, ZTA Gateways and Neurons for Secure Access. The advisory lists only Connect Secure. Watch for an update if that changes.

One operator check

Read the system software version off every Connect Secure node, including standby cluster members and any lab or DR appliance that still terminates VPN traffic, and compare it to the table above. You are looking for exactly 25.1.1.2, 22.8R2.5, or 25.1.3.0 or later. A cluster where only the active node was upgraded is still exposed through the other one if it can take traffic.

Then the harder part. Ivanti says "there are not reliable indicators of compromise available," and points customers who suspect exploitation to its Connect Secure 22.8x and 25x recovery steps. Patching closes the hole. It does not tell you whether someone used it first. Given that this was exploited before the backport shipped, treat any internet-facing node that sat on a vulnerable build this month as one to walk through those recovery steps, not only upgrade.

What this is not

This is not a bug in the Ivanti Secure Access client on laptops, it does not touch 22.7, and Ivanti describes the exploitation so far as limited to a small number of customers, not mass scanning. Ivanti has not published technical details of the spoofing, and the advisory references no public exploit code.

The details

• CVE: CVE-2026-104935, authentication bypass by spoofing (CWE-290).
• Severity: Ivanti rates it CVSS 8.6 (High), vector CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L: network reachable, no login, no user interaction.
• Impact: a remote unauthenticated attacker can execute arbitrary commands on the appliance.
• Exploitation: confirmed in the wild by Ivanti; on CISA KEV since 2026-10-13, federal due date 2026-10-16.
• Credit: Ivanti thanks Volexity for working with it on the issue.

A VPN gateway sits at the edge and holds the keys to everything behind it: user sessions, directory connections and a route into the internal network. Someone who can skip its login check can reach all of that. Patch first, then work through the recovery steps if any node was exposed.

References

• Ivanti Security Advisory: Ivanti Connect Secure (CVE-2026-104935)
• Ivanti Connect Secure 22.8x and 25x Recovery Steps
• Ivanti Connect Secure 25.x Upgrade and Migration Compatibility Guide
• CISA Known Exploited Vulnerabilities catalog