Key Facts
- CVE: CVE-2026-104935
- CVSS: Not yet scored
- Exploited in the wild: Yes, reported by the vendor and CISA KEV (added October 13, 2026)
- Fix available: Yes
- Last updated: October 13, 2026
What Is CVE-2026-104935?
CVE-2026-104935 is an Authentication Bypass by Spoofing vulnerability in Ivanti Connect Secure that lets a remote attacker run arbitrary commands on the device without logging in. Ivanti’s advisory does not describe any extra configuration needed beyond network access to the product.
Ivanti says fixed versions are available now for every affected branch. Versions 22.7.X and earlier do not contain the vulnerability, while the 22.8.X bridge release, 25.1.1.1 on ISA6000 and ISA8000 hardware, and 25.1.2.2 and earlier builds are affected. Ivanti credits Volexity with reporting the vulnerability and says it had already fixed part of the issue in the July 25.1.3.0 release before backporting the rest.
Organizations should prioritize any system still running the 22.8.X bridge release or a version before 25.1.3.0, since Ivanti had not finished backporting the fix to those lines when it published the advisory.
| CVE | Description | CVSS | Exploited in the wild |
|---|---|---|---|
| CVE-2026-104935 | Authentication Bypass by Spoofing in Ivanti Connect Secure | Not yet scored | Yes |
Is CVE-2026-104935 Being Exploited?
CVE-2026-104935 is being exploited in the wild, as reported by the vendor and CISA, which added it to its Known Exploited Vulnerabilities catalog on October 13, 2026.
What Is Ivanti Connect Secure?
Ivanti Connect Secure is a remote access product that organizations use to let employees connect securely to internal systems over a VPN connection, and it handles authentication for those connections.
Which Ivanti Connect Secure Versions Are Affected?
| Product | Affected Versions | Fixed Version |
|---|---|---|
| Ivanti Connect Secure (22.8.X) | 22.8R2.4 and prior | 22.8R2.5 |
| Ivanti Connect Secure (25.1.1.1, ISA6000/ISA8000) | 25.1.1.1 | 25.1.1.2 |
| Ivanti Connect Secure (25.1.2.2 and prior) | 25.1.2.2 and prior | 25.1.3.0, 25.1.3.1 |
Is Your Ivanti Connect Secure Affected?
- The vulnerability affects remote, unauthenticated connections to Ivanti Connect Secure, so no valid account is needed to attempt exploitation.
- Systems running Ivanti Connect Secure version 22.7.X or earlier do not contain this vulnerability.
- The 22.8.X release line is meant only as a temporary bridge toward version 25.1 and stays affected unless updated to 22.8R2.5 or 25.1.1.2.
How to Fix CVE-2026-104935
Ivanti has released fixed versions for every affected branch. Security teams should update Ivanti Connect Secure to the resolved version for their branch, such as 22.8R2.5, 25.1.1.2, or 25.1.3.0 and 25.1.3.1, and plan migration off the 22.7 and 22.8 lines before their end-of-life date of January 31, 2027.
- Preserve logs and system images from affected Ivanti Connect Secure appliances before making changes.
- Follow Ivanti’s recovery guidance to check for signs of compromise, since reliable indicators of compromise are not yet available.
- Update affected systems to the resolved version for their branch, such as 22.8R2.5, 25.1.1.2, or 25.1.3.0 and 25.1.3.1.
- Restrict network access to Ivanti Connect Secure management and gateway interfaces wherever possible.
The vendor advisory has full details and any later changes.
Known Issues With the Update
Migrating to version 25.1.3.0 requires new ISA4500, ISA6500, or ISA8500 hardware, or a rebuilt virtual or cloud appliance using the new template. Organizations not ready for that migration can apply the interim fix in 22.8R2.5 or 25.1.1.2 instead.
How to Check for Compromise
Ivanti says there are no reliable indicators of compromise for this vulnerability at this time. Organizations that suspect their Ivanti Connect Secure systems were compromised should follow the recovery steps posted in Ivanti’s guidance rather than relying on a specific scan or signature.
How watchTowr Is Helping Clients
The watchTowr Platform delivers Preemptive Exposure Management, identifying, validating, and mitigating external exposure across enterprise environments.
- Adversary Sight engine identified Ivanti Connect Secure instances across client environments and assessed exposure.
- Rapid Reaction identified exposure to this vulnerability across the watchTowr client base, giving teams the time they need to act.
Request a demo to see how Rapid Reaction identifies exposure to emerging threats like CVE-2026-104935.
