Organizations should immediately update Ivanti Connect Secure to the latest version per Ivanti's Security Advisory Ivanti Connect Secure (CVE-2026-104935). For version 22.8 appliances, note end-of-life is January 31, 2027; consult the Ivanti Connect Secure 25.x Upgrade and Migration Compatibility Guide for patching guidance. Conduct a factory reset and upgrade, or rebuild virtual instances. If compromise is suspected, perform network and memory forensics, reset all passwords, and revoke and reissue stored certificates, API keys, and license server credentials.
Quick answers
What is CVE-2026-104935?
Organizations should immediately update Ivanti Connect Secure to the latest version per Ivanti's Security Advisory Ivanti Connect Secure (CVE-2026-104935). For version 22.8 appliances, note end-of-life is January 31, 2027; consult the Ivanti Connect Secure 25.x Upgrade and Migration Compatibility Guide for patching guidance. Conduct a factory reset and upgrade, or rebuild virtual instances. If compromise is suspected, perform network and memory forensics, reset all passwords, and revoke and reissue stored certificates, API keys, and license server credentials.
How severe is CVE-2026-104935?
critical
Is CVE-2026-104935 known to be exploited?
It is not marked known-exploited in this record.
How should CVE-2026-104935 be mitigated?
Organizations should immediately update Ivanti Connect Secure to the latest version per Ivanti's Security Advisory Ivanti Connect Secure (CVE-2026-104935). For version 22.8 appliances, note end-of-life is January 31, 2027; consult the Ivanti Connect Secure 25.x Upgrade and Migration Compatibility Guide for patching guidance. Conduct a factory reset and upgrade, or rebuild virtual instances. If compromise is suspected, perform network and memory forensics, reset all passwords, and revoke and reissue stored certificates, API keys, and license server credentials.
CVSS
—
Vendor
Ivanti
Published
Oct 14, 2026 · 03:20
Patch
Unknown / not confirmed
Affected products
Ivanti Connect Secure
Mitigation
Organizations should immediately update Ivanti Connect Secure to the latest version per Ivanti's Security Advisory Ivanti Connect Secure (CVE-2026-104935). For version 22.8 appliances, note end-of-life is January 31, 2027; consult the Ivanti Connect Secure 25.x Upgrade and Migration Compatibility Guide for patching guidance. Conduct a factory reset and upgrade, or rebuild virtual instances. If compromise is suspected, perform network and memory forensics, reset all passwords, and revoke and reissue stored certificates, API keys, and license server credentials.
The Cybersecurity and Infrastructure Security Agency (CISA) has added two new vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog based on evidence of active exploitation. CVE-2026-96951 affects Microsoft Windows, and CVE-2026-104935 affects Ivanti Connect Secure. Both vulnerabilities are considered frequent attack vectors for malicious actors and pose significant risks, particularly to publicly exposed assets. CISA's Binding Operational Directive 26-04 requires Federal Civilian Executive Branch agencies to prioritize rapid remediation and check for prior compromise on these and other KEV Catalog-listed vulnerabilities.
The Cybersecurity and Infrastructure Security Agency (CISA) has added CVE-2026-104935 to its Known Exploited Vulnerabilities (KEV) Catalog, confirming that threat actors are exploiting a zero-day authentication bypass vulnerability in Ivanti Connect Secure. The flaw affects versions 25.1.1.1 and prior, 25.1.2.2 and prior, and 22.8R2.4 and prior, enabling remote, unauthenticated attackers to execute arbitrary commands for credential theft and data exfiltration. CISA added the vulnerability on October 13, 2026. Ivanti released a security advisory addressing the flaw, and organizations are urged to patch immediately. Version 22.8 appliances approach end-of-life on January 31, 2027.