Skip to content
Ivanti Connect Secure Vulnerability CVE-2026-104935 Actively Exploited

Ivanti Connect Secure Vulnerability CVE-2026-104935 Actively Exploited

First seen 13 Oct 2026, 19:58 UTC • •
API

Article Content

Browse articles
ThreatCluster AI
ThreatCluster •October 13, 2026 at 21:03 UTC
  • •CVE-2026-104935 allows unauthenticated remote command execution on Ivanti Connect Secure.
  • •CISA confirmed active exploitation and added the CVE to its KEV catalog on October 13, 2026.
  • •Patches are available for affected versions; immediate action is recommended for organizations.

On October 13, 2026, Ivanti disclosed CVE-2026-104935, a high-severity authentication bypass vulnerability in Ivanti Connect Secure, allowing remote, unauthenticated attackers to execute arbitrary commands. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) confirmed that this vulnerability is actively exploited in the wild and added it to its Known Exploited Vulnerabilities catalog on the same day. Affected versions include 25.1.1.1 and earlier, 25.1.2.2 and earlier, and 22.8R2.4 and earlier, while version 22.7R2.14 and prior are not affected. Ivanti has released patches for the vulnerable versions, and organizations are urged to apply these updates immediately. The vulnerability was initially discovered through Ivanti's security program and was partially fixed in July 2026. Volexity reported that the vulnerability was exploited in a chain of attacks, leading to unauthorized access to sensitive information. Organizations using Ivanti Connect Secure are advised to check for signs of compromise and follow recovery guidance provided by Ivanti.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Updated just now How this analysis works

Timeline

2024-01-10
CVE-2024-21887 added to CISA KEV
CISA flagged the vulnerability as actively exploited in the wild and added it to the Known Exploited Vulnerabilities catalog.
CISA KEV
2024-01-10
CVE-2023-46805 added to CISA KEV
CISA flagged the vulnerability as actively exploited in the wild and added it to the Known Exploited Vulnerabilities catalog.
CISA KEV
2024-01-31
CVE-2024-21893 published
Vulnerability assigned a CVE identifier and published in the National Vulnerability Database.
MITRE
2025-01-08
CVE-2025-0282 published
Vulnerability assigned a CVE identifier and published in the National Vulnerability Database.
MITRE
2025-04-03
CVE-2025-22457 published
Vulnerability assigned a CVE identifier and published in the National Vulnerability Database.
MITRE
2026-10-13
CVE-2026-104935 disclosed
Ivanti published an advisory for an authentication bypass vulnerability allowing remote command execution.
Watchtowr
2026-10-13
CISA adds CVE-2026-104935 to KEV
CISA confirmed the vulnerability is actively exploited and added it to the Known Exploited Vulnerabilities catalog.
Securityaffairs.Co
2026-10-13
Ivanti releases patches
Ivanti released updates for all affected versions and urged customers to apply them immediately.
Rapid7
2026-10-13
CVE-2026-109412 published
Vulnerability assigned a CVE identifier and published in the National Vulnerability Database.
MITRE
2026-10-13
CVE-2026-106042 published
Vulnerability assigned a CVE identifier and published in the National Vulnerability Database.
MITRE

More articles in this cluster (13)

Following this threat?

Track CISA and CVE-2023-46805 in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Extracted Entities (18)

1 / 4

Common questions

Which versions of Ivanti Connect Secure are affected?
Affected versions include 25.1.1.1 and earlier, 25.1.2.2 and earlier, and 22.8R2.4 and earlier.
What should organizations do in response?
Organizations should immediately apply the available patches for their affected versions and check for signs of compromise.
Is this vulnerability being exploited?
Yes, both Ivanti and CISA confirmed that CVE-2026-104935 is actively exploited in the wild.