critical severityConfidence highHistorical record

Ivanti Connect Secure login bypass exploited, on CISA KEV (CVE-2026-104935)

Ivanti Connect Secure (ICS) has an authentication bypass by spoofing (CWE-290) that lets a remote unauthenticated attacker execute arbitrary commands on the VPN appliance. Ivanti disclosed it on 2026-10-13, rates it CVSS 8.6 (High), and says it is aware of exploitation in the wild affecting a limited number of customers. CISA added it to the Known Exploited Vulnerabilities catalog the same day with a 2026-10-16 due date. Fixed builds: 25.1.1.2 (for 25.1.1.1 and prior), 25.1.3.0 or 25.1.3.1 (for 25.1.2.2 and prior), and 22.8R2.5 (for 22.8R2.4 and prior); Ivanti recommends 22.8 customers move to 25.1.1.2. ICS 22.7R2.14 and earlier are not affected. Ivanti says there are no reliable indicators of compromise yet and points suspected victims to its 22.8x and 25x recovery steps.

Also tracked as CVE-2026-104935 · Ivanti Connect Secure authentication bypass by spoofing · ICS CVE-2026-104935

First observed
Oct 13, 2026
Last observed
Oct 13, 2026
Last reviewed
Oct 13, 2026
Tracking ended
Oct 13, 2026

Record exports

JSON recordArtifact CSVSTIX 2.1 bundle

Uncertainty and limitations

Read the evidence limits before acting on this record.

Ivanti has not published technical details of the spoofing or indicators of compromise. The advisory lists only Connect Secure; Policy Secure, ZTA Gateways and Neurons for Secure Access are not mentioned. Vendor CVSS is 8.6 (High); this campaign marks severity critical because of confirmed in-the-wild exploitation and KEV listing, not a different score.

  • Tracks CVE-2026-104935 in Ivanti Connect Secure only.
  • Not in scope: ICS 22.7R2.14 and earlier, and 25.1.3.0 or later on ISA4500/ISA6500/ISA8500, which Ivanti says do not contain the bug.
  • No indicators of compromise are included because Ivanti says reliable ones are not available.
  • HOL blog is operator guidance, not a substitute for the vendor advisory.

Guard coverage and policy

What Guard's reviewed assertions do and do not claim for this campaign, and the reviewed starting points for defense.

No Guard coverage mapping is published for this record.

No campaign-specific policy guidance is published.

Safe next step. Campaign guidance is defensive context. It does not auto-apply policy or claim universal campaign coverage.

Open policy controlsCampaign-specific emergency policy starting point

Timeline

Reviewed events, oldest first, each tied to a verified source.

  1. Vendor action

    Per Ivanti's FAQ, a portion of the vulnerability was found internally and patched in the July 2026 release 25.1.3.0 (new ISA4500/6500/8500 platform). Exact July date not stated; first of month used as a placeholder.

  2. Vendor action

    Ivanti released ICS 25.1.1.2, which resolves the vulnerability for 25.1.1.1 and prior.

  3. Vendor action

    Ivanti released ICS 22.8R2.5, which resolves the vulnerability for 22.8R2.4 and prior.

  4. Disclosure

    Ivanti published the advisory for CVE-2026-104935 and confirmed exploitation in the wild affecting a limited number of customers. Volexity credited.

  5. Update

    CISA added CVE-2026-104935 to the KEV catalog (version 2026.10.13) with a due date of 2026-10-16.

  6. Update

    HOL Guard published the operator write-up for CVE-2026-104935.

Publication clock: 15.5 hours from reviewed disclosure timestamp to HOL publication; 12-hour critical target; historical backfill outside target.

Sources

Every claim on this record is traceable to the sources below.

Reviewed in full by HOL Guard Security Publishing.

Published
Last full review
Last modified

Report a correction

Record HGTC-2026-529AB19A