Get real-time updates on Telegram
CVE-2026-104935: connect secure from 25.1.0.0 (inclusive), before 25.1.1.2 (exclusive), from 25.1.2.0 (inclusive), before 25.1.3.0…
CVE-2026-104935 affects Ivanti Connect Secure. CVSS 3.1 base score 8.6 (HIGH, Source advisory). Listed in CISA KEV, added 13-Oct-2026.
Affected technology
connect secure · from 25.1.0.0 (inclusive), before 25.1.1.2 (exclusive)
ivanti
connect secure · from 25.1.2.0 (inclusive), before 25.1.3.0 (exclusive)
ivanti
connect secure · 22.8 · update r2
ivanti
connect secure · 22.8 · update r2.1
ivanti
connect secure · 22.8 · update r2.2
ivanti
connect secure · 22.8 · update r2.3
ivanti
connect secure · 22.8 · update r2.4
ivanti
Connect Secure · Exact affected versions not specified by the source
Ivanti
Description’s affected range: before version 25.1.3.0
Component: Not specified by the source
Attack conditions (Source advisory, CVSS 3.1): Network (remote) · No privileges required · No user interaction required
What an attacker can do
A remote unauthenticated attacker can execute arbitrary commands. Source advisory’s CVSS 3.1 assessment (base score 8.6/10) rates confidentiality impact as high; integrity and availability impact as low.
- CWE
- CWE-290
- Vendor
- Ivanti
- Product
- Connect Secure
- CCR priority
- 80.0 /100 (P1)
- CVSS 3.1
- 8.6 /10 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L · Source advisory
- KEV
- yes · added 2026-10-13 · due 2026-10-16
- Exploit signals
- CISA KEV listing.
Required action — CISA
Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
Provenance
- CISA Known Exploited Vulnerabilities Catalog (JSON) · Source record · observed 2026-10-13 20:14:11.114137+00:00 UTC
- GitHub Advisory Database · Source record · observed 2026-10-13 20:20:59.886514+00:00 UTC
- NVD CVE API 2.0 · Source record · observed 2026-10-13 20:16:59.278043+00:00 UTC
Stable permalink: https://cybercodered.org/item/cve-cve-2026-104935.html