Ivanti Connect Secure: exploited vulnerability allows unauthenticated command execution
An authentication bypass in Ivanti Connect Secure lets a remote attacker without credentials run commands on the gateway; it was exploited as a zero-day.
What happened
Vulnerability CVE-2026-104935 is an authentication bypass with a CVSS score of 8.6 that allows an unauthenticated remote attacker to execute commands. Ivanti confirmed it had been exploited as a zero-day against a limited number of customers. It affects versions 25.1.1.1 and earlier, 25.1.2.2 and earlier and 22.8R2.4 and earlier, and is fixed in 25.1.1.2, 25.1.3.0 or 25.1.3.1 and 22.8R2.5. Versions 22.7.x and earlier are not affected. The vendor advisory is dated 13 October.
Why it matters
A remote access gateway is the front door to the network: if commands can be executed without credentials, the attacker does not need to steal an account or wait for someone to click an email. That it was exploited before the patch was published shows that someone already knows and uses the technique, and that waiting a few days to update is not a neutral option. The extent of the exploitation is limited according to the vendor, but the flaw is within reach of anyone who can reach the IP address.
What we recommend
Update Connect Secure gateways to one of the fixed versions and review their logs for anomalous access. If the device cannot be updated the same day, it should be treated as an exposed service until it is, and what happens in its log should be watched, not just the patch management result.
Related service: ciberseguridad · infraestructura-cloud
Want to know how it affects you?
We review your environment and tell you what to prioritise, with no commitment.