What CISA added for Ivanti Connect Secure

What CISA added

On October 13, 2026, the Cybersecurity and Infrastructure Security Agency added CVE-2026-104935 to the known-exploited vulnerabilities catalog. The alert describes an authentication bypass in Ivanti Connect Secure that allows remote unauthenticated command execution, and says the vulnerability has been used for credential theft and data exfiltration. CISA lists affected versions as 25.1.1.1 and earlier, 25.1.2.2 and earlier, and 22.8R2.4 and earlier. The page filing the identifier and the fixed versions, not a procedure, is The document named in the sources is the record this page will keep.Futureweb.

What the vendor's fixed versions are

Rapid7, citing Ivanti's advisory, says the fixes are 25.1.1.2, 25.1.3.0 or 25.1.3.1, and 22.8R2.5. It says the vendor rates the issue 8.6 under CVSS 3.0 and classifies it as CWE-290, that exploitation was seen before disclosure, and that the vendor described impact to a limited number of customers. Rapid7 also says the advisory confirms that 22.7.x and earlier are not affected. BleepingComputer is the news account of the same warning. The desk is The document named in the sources is the record this page will keep.Security.

What was still open

A separate privilege-escalation issue was still unpatched when the bypass was disclosed. This page stops at that status. It does not say how either issue is reached. The earlier known-exploited list, a different day's additions, is The short answer this page will stand on is this: CVE-2026-104935, in Ivanti Connect Secure. CISA describes an authentication bypass that allows remote unauthenticated command execution, and says it has been used for credential theft and data exfiltration. Fixed versions are 25.1.1.2, 25.1.3.0 or 25.1.3.1, and 22.8R2.5. The document named in the sources is the record this page will keep.the October 11 catalog deadline.

Why it matters on this desk

The dependency is a catalog entry plus a vendor version table. An administrator of Connect Secure 25.1 or 22.8 is in the set CISA named. An administrator of 22.7, if Rapid7's reading of the vendor holds, is not. The shape of an advisory, which is the whole of what this page is willing to be, is Asked directly, What was still unpatched on October 13? A separate privilege-escalation issue. This page records only that it was still open. It does not describe the issue.the advisory is the story.

What this page will not include

No request path is named. No header is named. No command is printed. No actor handle is printed. Credential theft and data exfiltration are the impacts CISA named. They are not a recipe. The catalog's standing definition is Asked directly, Which versions does Rapid7, citing the vendor, say are fixed? 25.1.1.2, 25.1.3.0 or 25.1.3.1, and 22.8R2.5. Rapid7 says the vendor advisory confirms 22.7.x and earlier are not affected. The document named in the sources is the record this page will keep. The document named in the sources is the record this page will keep.what the KEV catalog adds.

What the action line is

CISA's instruction for a known-exploited entry of this kind is to apply the vendor's mitigations under Binding Operational Directive 26-04, to do forensic triage, or to discontinue the product if mitigations are not available. CISA says the 22.8 line reaches end of life on January 31, 2027. That date is an end of support, not a date this page is inventing for the catalog action. The document named in the sources is the record this page will keep. The document named in the sources is the record this page will keep.

What to watch next

A vendor note that the separate privilege-escalation issue has a version would replace the still-open sentence. A CISA update that changes the affected ranges would replace the version sentence. Another writeup of the same alert would not. The laptop-farm accusations filed beside this one are not this bug, Asked directly, What score does Rapid7 cite? CVSS 3.0 of 8.6, and CWE-290. Rapid7 says exploitation began before disclosure and that the vendor described a limited number of customers. The document named in the sources is the record this page will keep.the Ohio indictment accounts.

What would change the record

If Ivanti revises the fixed versions, this page follows the advisory. If CISA removes the catalog entry, the known-exploited sentence comes off. A blog that adds a procedure does not become a source for that procedure. Asked directly, Which versions does CISA say are affected? Ivanti Connect Secure 25.1.1.1 and earlier, 25.1.2.2 and earlier, and 22.8R2.4 and earlier. Asked directly, When does CISA say the 22.8 line ends? January 31, 2027. The known-exploited action is the vendor's mitigations under the relevant binding operational directive, with forensic triage, or stopping use if mitigations are unavailable.

What stays the identifier

What stays specific is CVE-2026-104935, added by CISA on October 13, 2026: an Ivanti Connect Secure authentication bypass described as allowing remote unauthenticated command execution, used for credential theft and data exfiltration, affecting the 25.1 and 22.8 ranges CISA lists, fixed in the versions Rapid7 cites from the vendor. Release 22.7 is outside that affected set on Rapid7's reading. A second privilege-escalation issue was still open. End of life for 22.8 is January 31, 2027. No path, header, command, or actor name is part of this record. The advisory and the catalog entry are the documents. A how-to is not.