Ivanti Connect Secure zero-day authentication bypass (CVE-2026-104935) exploited in the wild
Published 26/10/2026 10:54
Timeline
3 events over 13 d
- 13/10/2026ConfirmedCISA Known Exploited Vulnerabilities+0 min
- 13/10/2026ExploitedCISA Known Exploited Vulnerabilities+13 d
- 26/10/2026 10:54Published on WatchtowerPro CISO
In short
A zero-day authentication bypass in Ivanti Connect Secure (CVE-2026-104935, CVSS 8.6) lets a remote, unauthenticated attacker run commands on the appliance. Ivanti and CISA confirm it was exploited in the wild before disclosure. Ivanti has released patches, so affected appliances should be updated now. Shodan estimates about 6,059 internet-facing Ivanti Connect Secure (Pulse Secure) servers worldwide, 737 of them in the EU (26/10/2026); how many run an affected version is not yet known.
Affected versions
- Ivanti Connect Secure 25.1.1.1 and prior
- Ivanti Connect Secure 25.1.2.2 and prior
- Ivanti Connect Secure 22.8R2.4 and prior
Fixed in
- Ivanti has released patches together with its security advisory of 13/10/2026 (Ivanti advisory; BSI). The signals do not give the fixed version numbers for each branch (25.1 and 22.8), so take them from Ivanti's advisory.
What to do now
- Update Ivanti Connect Secure to the fixed version listed in Ivanti's advisory of 13/10/2026 as soon as possible. Ivanti has released patches, and BSI also asks operators to check Ivanti's recommended measures quickly. The signals do not give the exact fixed version numbers for the 25.1 and 22.8 branches, so take them from the advisory.
- For hardware and virtual appliances, CISA points to the Ivanti Connect Secure 25.x Upgrade and Migration Compatibility Guide.
- Attackers used this flaw for credential theft and data exfiltration, and exploitation began at least in early October 2026. Treat appliances that were exposed before patching as possibly compromised. Check them for signs of compromise and consider whether credentials handled by the appliance were exposed.
- No vendor interim measures are confirmed in the signals. Any interim measure would only reduce exposure, so updating remains necessary.
ReconX customers see the full notice - and their own systems
Our customers are alerted at every phase. Until a patch exists, the ReconX agent watches their servers from the inside for anomalies, and our outside view - the attacker's view - shows which systems to fix first.
In ReconX: the full analysis, 7 open questions, followed up as sources answer and all 8 sources with their dates. And technology matching: which of your systems run Ivanti Connect Secure (Pulse Secure), at which version, fixed or not - and what each one needs.
Main sources
Known exploited: Ivanti Connect Secure - Ivanti Connect Secure Authentication Bypass by Spoofing Vulnerability Vendor · Vulnérabilité dans Ivanti Connect Secure (ICS) (14 octobre 2026) CERT · BSI (Mastodon) CERT
Data: Shodan - Ivanti Connect Secure (Pulse Secure) (estimate, 26/10/2026)