Article
CISA KEV additions, 13 to 16 Oct 2026: patch order
CISA added nine exploited flaws to its KEV catalog from 13 to 16 October 2026. See each product, the fix, the due date and…
Read more
Exploited vulnerability
Ivanti Connect Secure bypass (CVE-2026-104935)
A flaw in Ivanti Connect Secure, a VPN gateway that lets staff reach company systems from outside.
- On CISA KEV
- CVE ID
- CVE-2026-104935
- CVSS
- 8.6 High (CVSS v3.1, NVD record from the CNA); Ivanti advisory also lists 8.6 High
- CISA KEV
- Listed
- Affected product
- Connect Secure
- Exploited
- 13 October 2026 (Ivanti advisory and CISA KEV listing)
- Published
- October 2026
In short
CVE-2026-104935 is a flaw in Ivanti Connect Secure, a VPN gateway that lets staff reach company systems from outside. A remote attacker with no login can trick the gateway about who is sending a request and then run commands on it. CISA lists the flaw as exploited, and Ivanti says it knew of attacks on a limited number of customers when it disclosed the flaw.
- CVECVE-2026-104935
- ProductIvanti Connect Secure
- CISA KEVListedKnown Exploited Vulnerabilities
- ExploitedYesin real attacks
- Fix Steps5actions listedUpdate to a fixed version · Find every gateway
What it allows
A remote attacker who has no account and needs no user action can run arbitrary commands on an affected Connect Secure gateway. Ivanti rates the flaw 8.6 (High) and NVD carries the same score for the CVSS v3.1 vector AV:N/AC:L/PR:N/UI:N. CISA's scoring data in the NVD record marks exploitation as active, the attack as automatable and the technical impact as total. A gateway sits at the edge of the network, so a compromise there gives an attacker a place to start from.
Who is affected
Per the Ivanti advisory, these versions are affected: 25.1.1.1 and earlier, 25.1.2.2 and earlier, and 22.8R2.4 and earlier. Fixed versions are 25.1.1.2 (released 5 October 2026), 25.1.3.0 and 25.1.3.1, and 22.8R2.5 (released 12 October 2026). Version 22.7R2.14 and earlier does not contain the flaw, according to Ivanti and NVD.
Ivanti says it found part of the flaw itself and fixed it in release 25.1.3.0 in July 2026. It was still moving the fix back to the other supported versions when attacks began. Moving to 25.1.3.0 needs the newer ISA4500, ISA6500 or ISA8500 platform. Both 22.7 and 22.8 reach end of life on 31 January 2027, and Ivanti tells customers to move to the 25.1 line before then.
CISA added the flaw to the Known Exploited Vulnerabilities (KEV) catalog on 13 October 2026 with a due date of 16 October 2026. The KEV entry shows ransomware use as Unknown and marks forensic triage as required. Neither CISA nor Ivanti names an attacker or a malware family, so this page does not either. Ivanti says exploitation touched a limited number of customers at disclosure and that few indicators of compromise exist so far.
Earlier Ivanti Connect Secure flaws also reached the KEV catalog. The authentication bypass CVE-2023-46805 was added on 10 January 2024. The command injection CVE-2024-21887 was added the same day. The stack overflow CVE-2025-0282 followed on 8 January 2025. The buffer overflow CVE-2025-22457 was added on 4 April 2025. CVE-2026-104935 is the newest of the five.
Timeline
-
July 2026
Ivanti releases Connect Secure 25.1.3.0, which already fixes part of the flaw.
-
5 Oct 2026
Ivanti releases 25.1.1.2, a fixed version for the 25.1.1 line.
-
12 Oct 2026
Ivanti releases 22.8R2.5, a fixed version for the 22.8 line.
-
13 Oct 2026
Ivanti publishes its advisory and says it knows of exploitation. NVD publishes the record. CISA adds the flaw to the KEV catalog.
-
16 Oct 2026
CISA due date for federal agencies to apply the vendor's mitigations.
What to do
-
Update to a fixed version
Move 25.1.1.1 and earlier to 25.1.1.2 or later, 25.1.2.2 and earlier to 25.1.3.0 or 25.1.3.1 (this needs the ISA4500, ISA6500 or ISA8500 platform), and 22.8R2.4 and earlier to 22.8R2.5 at least. Plan the move off 22.8 and 22.7 to the 25.1 line before 31 January 2027.
-
Find every gateway
List each Connect Secure appliance, physical, virtual or cloud, with its version. Check which ones are reachable from the internet, since those face the most risk.
-
Run the Integrity Checker Tool
Ivanti says there are few indicators of compromise, so it points customers to its Integrity Checker Tool and asks them to run it regularly. Run it on every gateway, patched or not.
-
Hunt for signs of access
CISA marks forensic triage as required for this entry. Keep appliance logs, check for unknown admin accounts and changed settings, and look for odd outbound connections from the gateway.
-
If you suspect a compromise
Follow the recovery steps in the Ivanti advisory. Treat credentials and keys stored on the gateway as exposed and replace them after the rebuild.
Questions
What is CVE-2026-104935?
It is an authentication bypass by spoofing (CWE-290) in Ivanti Connect Secure. A remote attacker with no login can run arbitrary commands on the gateway. Ivanti and NVD rate it 8.6 (High).
Which Connect Secure versions are affected?
Ivanti lists 25.1.1.1 and earlier, 25.1.2.2 and earlier, and 22.8R2.4 and earlier. Version 22.7R2.14 and earlier does not contain the flaw. Fixed versions are 25.1.1.2, 25.1.3.0, 25.1.3.1 and 22.8R2.5.
Is CVE-2026-104935 being exploited?
Yes. Ivanti says it knows of exploitation against a limited number of customers, and CISA added the flaw to the KEV catalog on 13 October 2026. It is one of nine flaws listed in our CISA KEV roundup for 13 to 16 October 2026.
Has anyone been named as the attacker?
No. Neither the Ivanti advisory nor the CISA entry names an attacker or a malware family, and the KEV ransomware field shows Unknown.
In our research
- CISA KEV additions, 13 to 16 Oct 2026: patch order October 2026
Sources
Browse the threat library
- APT groups State-backed hacking groups, who they go after and how they get in. 51 profiles
- Countries The sectors, groups and national bodies that matter in each country. 32 profiles
- Ransomware groups How each group gets in, how it extorts and what stops it. 25 profiles
- Malware and tools Malware families and abused tools, what they do and how to spot them. 54 profiles
- Techniques Attack techniques in plain words, mapped to MITRE ATT&CK. 37 profiles
- Vulnerabilities Flaws attackers use in real attacks and what to do about them. 50 profiles
- Significant Cyber Incidents Significant incidents since October 2024, with a dated timeline, sources and lessons. 105 profiles
Stay Ahead of
Digital Threats
Take control of your digital security with an exclusive demo of our AI-driven threat intelligence platform.