Ivanti Connect Secure update addresses exploited remote-access flaw

Ivanti reported active exploitation of CVE-2026-104935 in Connect Secure, according to an MS-ISAC advisory issued on 13 October. The bulletin says the authentication bypass could allow a remote attacker to execute commands without signing in. Connect Secure is an enterprise remote-access gateway.

The affected branches include 25.1.1.1 and earlier, 25.1.2.2 and earlier, and 22.8R2.4 and earlier. The advisory lists fixes in 25.1.1.2, 25.1.3.0/25.1.3.1 and 22.8R2.5, and recommends applying appropriate updates promptly after testing.

MS-ISAC also relays Ivanti’s recommendation that customers on 22.8 move to 25.1.1.2 or later because the older branch reaches end of life on 31 January 2027. That future support date is a planning consideration, separate from the immediate exploitation warning.

The advisory specifically excludes 22.7R2.14 and earlier from this vulnerability’s impact. That exception does not establish the absence of other security issues. The bulletin does not identify a victim count or attribute the attacks to a named actor.