A flaw in Ivanti Connect Secure is under active attack, according to security coverage of a United States Cybersecurity and Infrastructure Security Agency listing. The vulnerability, tracked as CVE-2026-104935, was added to CISA's Known Exploited Vulnerabilities catalogue on 13 October 2026, which means there is reliable evidence of attacks in the wild.

What the flaw does

The flaw is described as an authentication bypass by spoofing in Ivanti Connect Secure versions before 25.1.3.0, allowing a remote unauthenticated attacker to execute arbitrary commands. It does not affect version 22.7R2.14 or earlier, according to the vulnerability description. Connect Secure is a remote-access gateway, so a flaw that allows unauthenticated command execution is particularly serious: it can give an attacker a foothold at the edge of a network.

How urgent is it

The flaw carries a CVSS severity score of 8.6 out of 10, rated high, in the United States National Vulnerability Database. A predictive model cited in security coverage put the probability of exploitation somewhere in the next 30 days at 26 percent, higher than 98 percent of scored vulnerabilities. United States federal agencies were required to fix it by 16 October 2026 under CISA's binding directive, a deadline that has already passed.

What to do

Administrators should check which version they are running, upgrade to a fixed release, and look for signs of compromise if a vulnerable version was exposed to the internet. Rotating credentials and checking for unexpected accounts or scheduled tasks are sensible follow-up steps after patching. As always, verify the current vendor advisory before acting. Sources: CISA Known Exploited Vulnerabilities catalogue; National Vulnerability Database summary.