Ivanti has shipped emergency fixes for a severe authentication-bypass vulnerability in Connect Secure, the remote-access software widely deployed by enterprises to let employees reach internal networks from outside the office. The company disclosed the flaw, tracked as CVE-2026-104935, on October 13, 2026, and confirmed that exploitation had already affected a limited number of customers before a patch existed. That detail transforms this from a routine advisory into an urgent remediation task for any organization running the product.
A Bypass That Needs No Password
The vulnerability carries a CVSS v3.0 score of 8.6 and falls under CWE-290, a category describing authentication bypass through spoofing. In practical terms, an attacker does not need stolen credentials, a phishing success, or any interaction from a victim. The flaw is reachable over the network and rated low in attack complexity, meaning the technical bar for exploitation is modest for anyone who finds an exposed appliance. Ivanti's advisory describes the consequence bluntly: successful exploitation allows arbitrary command execution, effectively handing an intruder control over the device. The impact breakdown shows a high loss of confidentiality paired with comparatively lower damage to data integrity and system availability, suggesting the primary risk is unauthorized access to sensitive information rather than outright destruction of data.
Sorting Out Which Versions Are at Risk
Ivanti's guidance is specific about the affected branches, and administrators should treat the version table as the authoritative reference rather than relying on a single headline figure. The vulnerable releases include:
- ICS 25.1.1.1 and earlier, resolved in version 25.1.1.2
- ICS 25.1.2.2 and earlier, resolved in versions 25.1.3.0 and 25.1.3.1
- ICS 22.8R2.4 and earlier, resolved in version 22.8R2.5
Notably, Ivanti states that ICS 22.7R2.14 and earlier branches are not affected, which separates an older, unaffected lineage from the newer branches named above. This distinction matters because organizations sometimes assume that any version older than a cited fixed release shares the same exposure. That is not the case here, and mismatched assumptions could lead teams to either over-patch unaffected systems or, worse, overlook a branch that genuinely needs attention.
Confirmed Exploitation, Limited Transparency
Ivanti's acknowledgment that exploitation occurred before disclosure elevates this beyond a theoretical risk. Yet the advisory is notably thin on specifics: it does not name the threat actors, the organizations affected, the exploitation timeline, or the exact commands attackers ran. There are no published indicators of compromise, and the precise spoofing mechanism behind the authentication bypass remains undescribed in the public advisory. An update issued on the same disclosure date added a reference to a Volexity blog post within the advisory's frequently asked questions, pointing to independent research that may offer further technical detail, though that material falls outside what Ivanti has formally documented.
This gap in detail carries a practical warning. The fact that only a limited number of customers were confirmed affected at disclosure time should not be read as reassurance for everyone else. Remote-access appliances exposed to the internet are routinely scanned by opportunistic attackers the moment a vulnerability becomes public, and historical patterns with edge-network software show that disclosure often accelerates exploitation attempts rather than ending them.
What Organizations Should Do Now
Ivanti's remediation path is a software update, available through the Ivanti License System, with no alternative workaround offered in the current guidance. That absence of a stopgap measure means patching is not optional for affected deployments; it is the only sanctioned fix. Administrators should verify their running version against the advisory's release table, prioritize internet-facing instances, and treat the presence of a patch as a starting point for investigation rather than proof of safety. Because exploitation predated disclosure, appliances that were vulnerable before the fix was applied may already carry signs of compromise, and organizations should review logs and access patterns rather than assume that installing the update closes the matter entirely.