Ivanti Confirms Active Exploitation of CVE-2026-104935 in Connect Secure
A vulnerability in Ivanti Connect Secure enables unauthenticated remote command execution and is already being exploited. CISA has given U.S. federal agencies until October 16 to remediate it.
CVE-2026-104935 Ivanti is a vulnerability in limited versions of the Ivanti Connect Secure VPN solution. The vendor has confirmed limited active exploitation in the real world. Ivanti published the information on October 13, 2026, and recommended that administrators of affected devices immediately upgrade to a fixed version.
This is an authentication bypass rated CVSS 8.6. According to the CVE record, a remote attacker can execute arbitrary commands without logging in. For internet-facing remote access gateways, the priority is therefore not only deploying the fix but also checking whether the device shows signs of compromise.
CVE-2026-104935 Ivanti Is Now in the KEV Catalog
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added the vulnerability to the Known Exploited Vulnerabilities (KEV) catalog on October 13, an inventory of vulnerabilities with confirmed exploitation. It set a remediation deadline of October 16, 2026, for U.S. federal civilian agencies.
Inclusion in KEV does not change the technical nature of the vulnerability, but it confirms that this is not merely a theoretical scenario. Ivanti said it has observed limited exploitation. Public sources have not yet identified who is behind the attacks or their full scope. It has also not been independently confirmed how many organizations were attacked.
Ivanti recommends upgrading to a fixed release and regularly using the Integrity Checker Tool. Administrators should follow the vendor’s instructions for their deployed version of Connect Secure and review the integrity-check results. Given the confirmed exploitation, simply waiting for the regular maintenance window is not an appropriate approach.
Microsoft Fixed More Than 1,400 Vulnerabilities
Microsoft’s October Patch Tuesday also delivered fixes for more than 1,400 CVEs. The package includes the actively exploited CVE-2026-96951 vulnerability in Windows Shell.
The exact number of fixed vulnerabilities varies across secondary summaries, so “more than 1,400” is the safely confirmed description. The release’s scale increases demands on security teams, which must coordinate testing and deployment of updates in Windows environments alongside the urgent Ivanti fix.
What Administrators Should Do
- Verify whether the organization operates an affected version of Ivanti Connect Secure, especially if the gateway is internet-facing.
- Deploy the vendor-provided fix without unnecessary delay.
- Run the Integrity Checker Tool as recommended by Ivanti and check for possible signs of compromise.
- Add Microsoft’s October security updates to the priority deployment plan, including the CVE-2026-96951 fix.
It is important to monitor whether Ivanti publishes additional technical indicators of compromise, information attributing the attacks, or a fix for the related privilege-escalation issue mentioned in secondary reports. Any reports of problems after deployment of Microsoft’s extensive October package will also be important.
Sources
- Ivanti — October 2026 Security Update – Ivanti confirms limited active exploitation of the Connect Secure vulnerability, recommends immediate updating, and advises using the Integrity Checker Tool.
- CVE Program — CVE-2026-104935 – The Ivanti-assigned record describes an authentication bypass, remote unauthenticated command execution, and a CVSS score of 8.6; it also includes CISA’s active-exploitation enrichment.
- NIST NVD — CVE-2026-104935 – Confirms the vulnerability status, affected and fixed versions, and its addition to the CISA KEV catalog on October 13, with a remediation deadline of October 16.
- Microsoft Security Update Guide – Microsoft’s official source for security fixes released as part of Patch Tuesday.
- The Record – Corroborates the addition of the Ivanti vulnerability to KEV, exploitation of CVE-2026-96951, and the scale of Microsoft’s October release.
Verified and updated: October 14, 2026 15:24
