On 13 October Ivanti published an advisory for CVE-2026-104935: an authentication bypass in Connect Secure that allows remote command execution without logging in. Ivanti says part of the flaw was patched back in July, but only in version 25.1.3.0. The same day CISA also added a Windows Shell flaw to its catalog of exploited vulnerabilities, with a deadline of 16 October for US federal civilian agencies.
- 13 October 2026: Ivanti published an advisory for CVE-2026-104935 in Connect Secure. A remote attacker with no login can run arbitrary commands. CVSS 8.6 (High); Ivanti says it is aware of exploitation affecting a limited number of customers.
- Affected: 25.1.1.1 and earlier, 25.1.2.2 and earlier, and 22.8R2.4 and earlier. Fixed in 25.1.1.2, 25.1.3.0, 25.1.3.1 and 22.8R2.5. Ivanti had already patched part of the flaw in July, in version 25.1.3.0.
- The same day CISA added CVE-2026-96951 in Windows Shell (command injection, rated 8.8 by Microsoft) to the KEV catalog. Both have a deadline of 16 October for federal civilian agencies. There is no Microsoft text among the sources I checked; the Windows description comes from NVD.
Version 25.1.3.0 of Ivanti Connect Secure came out in July and does not contain this week's flaw. But it needs Ivanti's new platform. The problem is for everyone still running something else.
Ivanti admits it in its own advisory, no dodging. The company writes that it found part of the flaw itself, in its product security program, and patched it in the July release. The fix for the other supported versions was still being backported when exploitation occurred. How many customers are affected isn't stated beyond a limited number. Who is attacking isn't either.
The dates in the advisory show how the backporting went. 25.1.1.2 is from 5 October, 22.8R2.5 from 12 October. The advisory is from the 13th.
Windows is the quieter half of the day. Affected versions run from Windows 10 and Windows Server 2012 R2 up to Windows 11 26H2 and Server 2025, and Microsoft's vector says user interaction is required. I couldn't open Microsoft's advisory. So for Windows we know two things: what NVD says, and that CISA listed it as exploited. How it is exploited, and by whom, isn't in the sources I checked.
On Connect Secure the version comes first. On the old platform the fix is 25.1.1.2, and on 22.8, if you can't move to 25.1 right away, also 22.8R2.5. The 22.8 line reaches end of life on 31 January 2027 anyway, and Ivanti wants the migration to 25.1 done by then. The version doesn't tell you whether someone has already been inside, though. For that Ivanti offers the Integrity Checker Tool and advises running it regularly: for now there are few indicators of compromise.