Swiss SME Cyber Alert: Ivanti Connect Secure – actively exploited VPN flaw enables unauthenticated commands
Ivanti has warned of CVE-2026-104935 in Connect Secure, a VPN gateway used for secure remote access. Attackers can make vulnerable systems execute commands from the internet without signing in, and exploitation has been confirmed.
If your company or IT provider operates Ivanti Connect Secure, ask for the version, patch status and any signs of compromise to be checked today.
What happened?
Ivanti published its advisory on 13 October 2026 and confirmed exploitation affecting a limited number of customers. CISA added the flaw to its Known Exploited Vulnerabilities catalogue the same day. Volexity observed attacks from 3 October against a system that was fully patched at the time and running version 22.8R2.4.
Could my company be affected?
Your company may be exposed if Ivanti Connect Secure provides VPN access for staff or external partners, including appliances managed by an IT provider. Affected releases are 25.1.1.1 and earlier in that code line, 25.1.2.2 and earlier in that code line, and 22.8R2.4 and earlier in that code line. Ivanti states that 22.7.x and earlier do not contain this vulnerability.
What should you do now?
Ask your IT provider to act on three points now:
Confirm whether Ivanti Connect Secure is in use and identify the running version.
Upgrade immediately to the resolved release for the relevant code line.
Look for signs of compromise even after patching and follow Ivanti's recovery and forensic guidance if suspicious activity is found.
How urgent is it?
Very high – act today. The vulnerability is being actively exploited, can be reached over the network without credentials and affects a VPN gateway at the edge of the company network. Do not wait for the next routine maintenance window.
Information for your IT provider
CVE-2026-104935 is an authentication bypass leading to command execution and has a CVSS score of 8.6. Ivanti lists these resolved releases:
25.1.1.1 and earlier in that code line → 25.1.1.2
25.1.2.2 and earlier in that code line → 25.1.3.0 or 25.1.3.1
22.8R2.4 and earlier in that code line → 22.8R2.5
The observed attack chain also used a separate privilege-escalation flaw to obtain root access; at disclosure, Ivanti said a further update for that issue would follow. Volexity also notes that the Ivanti Integrity Checker may miss the in-memory attack chain, so suspected compromise requires network and memory forensics.
