Ivanti has shipped fixes for a high-severity flaw in its Connect Secure appliances that allows attackers with no credentials and no user interaction to slip past authentication and run commands on vulnerable systems. The company disclosed the vulnerability, tracked as CVE-2026-104935, on October 13, 2026, and confirmed that exploitation had already touched a limited number of customers before the patch became available. For organizations running Connect Secure as a remote-access gateway, the update is not a routine maintenance item - it addresses a flaw that was being used against real deployments.
What makes this flaw so dangerous
The vulnerability carries a CVSS v3.0 score of 8.6 and falls under CWE-290, a category describing authentication bypass through spoofing - essentially, tricking a system into treating an unauthorized request as legitimate. What elevates the risk is the combination of factors involved: the flaw is reachable over the network, requires low attack complexity, and needs no valid credentials or active session from the victim. Successful exploitation leads to a high loss of confidentiality, with lesser but still notable effects on data integrity and system availability. Appliances like Connect Secure sit at the edge of corporate networks, brokering remote access for employees, which means a compromised gateway can become a direct path into internal systems rather than an isolated incident.
Which versions are exposed
Ivanti's advisory lays out specific version branches affected by the flaw, and administrators need to check their deployment against this list rather than assume blanket exposure across all older releases.
- ICS 25.1.1.1 and earlier - resolved in version 25.1.1.2
- ICS 25.1.2.2 and earlier - resolved in versions 25.1.3.0 and 25.1.3.1
- ICS 22.8R2.4 and earlier - resolved in version 22.8R2.5
Ivanti has explicitly stated that ICS version 22.7R2.14 and earlier branches are not affected, which separates them from the vulnerable lines above. This distinction matters: patching strategy should follow the specific branch an organization runs, not a general assumption that "older means vulnerable." Fixed builds are distributed through the Ivanti License System, and no workaround is offered as an alternative to upgrading - the software update is the only remedy described in the advisory.
What remains unknown - and why that matters
Ivanti's disclosure confirms exploitation occurred but withholds operational detail. The advisory does not name the attackers, identify affected organizations, describe a timeline of the campaign, or detail which commands were run against compromised systems. It also lacks indicators of compromise and does not explain the precise spoofing technique used to defeat authentication. An October 13 update to the advisory noted that a blog post from the security research firm Volexity had been added to the frequently asked questions, though the underlying findings from that research were not detailed in Ivanti's own materials.
These gaps limit what defenders can conclude about scale or intent. A vendor's acknowledgment that only a limited number of customers were affected at disclosure time should not be read as reassurance for everyone else - it reflects what was known at that moment, not a ceiling on how far exploitation might have spread since. Appliances exposed to the internet, as remote-access gateways typically are, remain attractive targets until patched.
What organizations should do now
Because exploitation predates the public fix, installing the update closes the hole but does not retroactively confirm an appliance was untouched. Security teams should treat patching as the first step, not the last: verifying current running versions against Ivanti's release table, prioritizing internet-facing instances, and reviewing logs and configurations for signs of unauthorized access are reasonable follow-up measures. Authentication-bypass flaws in edge infrastructure have repeatedly proven attractive to sophisticated intrusion campaigns in recent years, precisely because they offer a foothold without the need to steal credentials first. That pattern underscores why rapid patching of network-facing access infrastructure remains one of the most consequential, if unglamorous, tasks in enterprise security.
