Hackers are exploiting a previously unknown flaw in Ivanti Connect Secure, a VPN gateway that many organisations use to let staff connect to internal networks from outside. The US Cybersecurity and Infrastructure Security Agency (CISA) added the flaw, tracked as CVE-2026-104935, to its catalogue of known exploited vulnerabilities on 13 October 2026 [1]. It gave US federal civilian agencies a due date of 16 October to deal with it.
What the flaw does
CISA describes it as an authentication bypass by spoofing. In plain terms, an attacker can trick the gateway into treating them as a trusted user. CISA says the flaw “allows a remote unauthenticated attacker to execute arbitrary commands” [1]. That means someone on the internet, without a login, could run their own commands on the device.
BleepingComputer reports that the cybersecurity firm Volexity reported the flaw to Ivanti, and that it affects Connect Secure versions 22.8R2.4 and earlier, 25.1.2.2 and earlier, and 25.1.1.1 and earlier [2].
What Ivanti says
Ivanti said, as quoted by BleepingComputer: “At the time of disclosure, Ivanti is aware of limited exploitation in the wild. We are working directly with those organizations while making information, updates and remediation available to the broader customer community. If you are running one of the impacted versions, Ivanti recommends you act immediately” [2].
Ivanti also told customers to review its security advisory, upgrade to the fixed version as soon as possible and run its Integrity Checker Tool regularly [2]. TSN could not confirm the fixed version numbers from Ivanti’s own advisory, so we have not listed them here. Customers should check the advisory directly.
How many devices are exposed
The internet-monitoring group Shadowserver tracks more than 5,500 Connect Secure instances exposed online, according to BleepingComputer [2]. It is not known how many of those are decoys set up by researchers or have already been fixed.
Why the CISA list matters
CISA’s catalogue lists flaws it has evidence are being used in real attacks. Federal civilian agencies must fix listed flaws by the due date. Many companies also use the list to decide what to patch first. A three-day window, from 13 to 16 October, is short and shows how urgent CISA thinks this is [1].
VPN gateways like this one sit at the edge of a network, so a flaw in one can give attackers a way in. BleepingComputer notes that hackers have often exploited Ivanti flaws, sometimes as zero-days [2].
What this means
- If you run Ivanti Connect Secure, check your version now. The affected versions are listed above.
- Use Ivanti’s advisory for the fix. Upgrade to the fixed version it names and run the Integrity Checker Tool.
- The 16 October date is a federal deadline, but it is a useful guide for everyone else too.
Sources
- CISA, Known Exploited Vulnerabilities Catalog (JSON feed), entry CVE-2026-104935, added 13 October 2026. https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
- BleepingComputer (Sergiu Gatlan), “Ivanti warns of Connect Secure zero-day exploited in attacks”, 13 October 2026. https://www.bleepingcomputer.com/news/security/ivanti-warns-of-connect-secure-zero-day-exploited-in-attacks/
