Security Appliance: Attackers exploit vulnerability in Ivanti Connect Secure

A spoofing vulnerability in Ivanti Connect Secure allows remote attackers to execute arbitrary commands on the device. The manufacturer reports this in a brief security notice. Ivanti states that no prior authentication is required for exploitation and that attacks on vulnerable devices are already underway.

The security vulnerability with the CVE ID CVE-2026-104935 has a CVSS3 score of 8.6, a high severity, and is apparently easy to exploit remotely (Attack Vector: Network; Attack Complexity: Low). The US cybersecurity agency CISA has added the vulnerability to its database of “Known Exploited Vulnerabilities”, co-discoverer Volexity has published a detailed analysis .

Ivanti states that the following versions are affected: 25.1.1.1, 25.1.2.2, 22.8R2.4 and older versions; updates to versions 25.1.1.2, 25.1.3.0, 25.1.3.1, and 22.8R2.5 are available. Interesting: the first bug-fixed version 25.1.3.0 was released in July of this year, the remaining updates on October 5th. Ivanti does not explain how the temporal discrepancy for older firmware versions came . Admins should update their devices quickly; attacks on vulnerable Connect Secure instances are ongoing.

Security vulnerabilities in Ivanti products are frequently exploited for attack campaigns by cybercrime and state actors. Most recently, severe flaws were found in Ivanti Connect Secure (ICS) in September 2025 , and before that in April of the same year. The malware “ Resurge ” exploited a flaw in ICS to compromise networks.

This article was originally published in German . It was translated with technical assistance and editorially reviewed before publication.