CISA added an Ivanti Connect Secure flaw, CVE-2026-104935, to its Known Exploited Vulnerabilities catalog on October 13, 2026, with a due date of October 16, 2026 for federal agencies. The flaw lets a remote attacker with no login run commands on the VPN appliance. If your business uses Ivanti Connect Secure for remote access, that appliance is the first thing to check.
What the flaw is
CISA’s catalog names it “Ivanti Connect Secure Authentication Bypass by Spoofing Vulnerability” and describes it as one that lets a remote, unauthenticated attacker execute arbitrary commands. The weakness is classed as CWE-290. CISA lists known ransomware campaign use as “Unknown,” which means CISA has not tied it to ransomware. It does not mean the flaw is harmless.
The NVD record, published October 13, 2026, scores it 8.6 (High) under CVSS 3.1. The vector shows it can be attacked over the network (AV:N), with low complexity (AC:L), no privileges (PR:N) and no user interaction (UI:N). CISA’s assessment recorded in the NVD entry marks exploitation as active, the attack as automatable, and the technical impact as total. In plain terms: an attacker needs no account, no tricks and no help from your staff, and the attack is marked automatable.
Who is affected
Any organization running Ivanti Connect Secure on a build in the affected ranges. The NVD record lists these ranges:
- 25.1.0.0 up to, but not including, 25.1.1.2
- 25.1.2.0 up to, but not including, 25.1.3.0
- 22.8 R2 builds, listed individually as 22.8R2 through 22.8R2.4
NVD’s description says the flaw affects versions before 25.1.3.0 and that versions 22.7R2.14 and earlier are not affected. Two details deserve care. First, NVD’s ranges do not mention builds from 25.1.1.2 up to, but not including, 25.1.2.0, so do not assume those are either affected or clear. Second, a range that ends at a version does not by itself name a fixed build. Confirm your exact build, and the fixed build for it, against Ivanti’s published security advisory.
If you do not run Ivanti Connect Secure, this one is not about you. You can note it and move on.
What to do, in order
- Find out whether you have one. Ask whoever set up your remote access, or check your firewall and VPN inventory for Ivanti or Connect Secure.
- Get the exact build number. Ask your installer to confirm it and write it down.
- Compare it to Ivanti’s advisory. Use Ivanti’s published security advisory. CISA’s required action is to apply mitigations in accordance with vendor instructions, to follow its BOD 26-04 guidance and its “Forensics Triage Requirements,” and to stop using the product if mitigations are not available.
- Apply the vendor’s update or mitigation. If you must use a maintenance window, schedule it first among your pending changes.
- Review for signs of misuse. Check the appliance for unexpected admin accounts, unfamiliar configuration changes and logins from places you do not expect. If you find anything unusual, treat the appliance as compromised.
- Rotate credentials if there is doubt. If the appliance was exposed on an affected build, change the passwords of accounts that have used it, starting with administrators.
- Turn on multifactor authentication for VPN users if it is not already on. It does not fix this flaw, but it limits what a stolen password can do.
- Write down the result. Record the build you found, the date you updated, and who reviewed the logs. If an insurer, a customer or a contract asks later, you will have the answer.
What can wait
Redesigning remote access, replacing the VPN with a different approach, and rewriting your remote-work policy are worthwhile projects, but they should not hold up the update. Do the patch or mitigation first, then plan the larger work.
You also do not need to rebuild everything on suspicion alone. If your build is clearly outside the affected ranges and Ivanti’s advisory agrees, record that and stop.
A common mistake
One mistake to avoid is applying the update and not checking whether the device was already used by an attacker. A patch closes the door; it does not tell you whether someone is already inside. Another is leaving the appliance with no named owner. Assign one person to watch vendor advisories for it, and ask your installer whether administration of the appliance is restricted to a known address range.
Related item on the same list
CISA also added CVE-2026-76519 on October 14, 2026, a relative path traversal flaw in Cisco Secure Email Gateway that could let an unauthenticated, remote attacker write arbitrary files on the underlying operating system. Its due date is October 17, 2026. Cisco’s advisory cisco-sa-esa-afw-zqYJkjxp reports active exploitation. A device is affected only when File Reputation is enabled and assigned to a mail policy, and Content Scanner Tools is earlier than 25.3.0.5525. Cisco says no workarounds are available; the fix is to upgrade to AsyncOS 15.5.5-014 or 16.5.0-780, or to update Content Scanner Tools to 25.3.0.5525 or later.
Why the due date matters to you
The October 16 and October 17 dates apply to federal agencies, not to private businesses. A small business that treats the same dates as its own target is following a sensible schedule.
When to get help
Ask for help if you cannot tell what your VPN is, if nobody can log in to the appliance, or if the review turns up anything that looks wrong. Our cybersecurity and network services engineers can identify the device, confirm its version and check it for signs of misuse. Reach us through contact us.