Ivanti Connect Secure Remote Code Execution Vulnerability

Back Hkcert

Ivanti Connect Secure Remote Code Execution Vulnerability

Hkcert • October 14, 2026

Share: View original

A vulnerability has been identified in Ivanti Connect Secure. A remote attacker could exploit this vulnerability to trigger remote code execution, security restriction bypass and spoofing on the targeted system.

CVE-2026-104935 is being exploited in the wild. Authentication bypass by spoofing in Ivanti Connect Secure allows a remote unauthenticated attacker to execute arbitrary commands. Hence, the risk level of this vulnerability is rated as Extremely High Risk.

Remote Code Execution

Security Restriction Bypass

System / Technologies affected

Versions prior or equal to:

Ivanti Connect Secure (ICS) 22.8R2.4

Ivanti Connect Secure (ICS) 25.1.1.1

Ivanti Connect Secure (ICS) 25.1.2.2

Before installation of the software, please visit the vendor web-site for more details.

Apply fixes issued by the vendor:

Vulnerability Identifier

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Ivanti Connect Secure Zero-Day CVE-2026-104935 Exploited in the Wild On October 13, 2026, Ivanti disclosed a high-severity zero-day vulnerability tracked as CVE-2026-104935, affecting its Connect Secure (ICS) VPN appliances. This authentication bypass flaw allows unauthenticated attackers to execute arbitrary commands, with exploitation confirmed since at least October 1. The vulnerability impacts versions 25.1.1.1 and earlier, 25.1.2.2 and earlier, and 22.8R2.4 and earlier. Security firm Volexity identified the exploitation chain, which includes two patched vulnerabilities and one unpatched privilege escalation flaw. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added the CVE to its Known Exploited Vulnerabilities catalog on the same day as the disclosure, urging immediate patching. Organizations are advised to apply the latest updates and conduct forensic investigations to check for signs of compromise. 43 sources 73

Extracted Entities

Attack Types (3)

Authentication Bypass Remote Code Execution Spoofing

CVEs (1)

CVE-2026-104935

CWE Weaknesses (1)

CWE-287 - Improper Authentication

Platforms (1)

Ivanti Connect Secure