Severity: Critical | Priority: 1
On October 13, 2026, Ivanti warned customers to patch CVE-2026-104935 immediately. It is an actively exploited authentication bypass in Ivanti Connect Secure, the remote-access VPN gateway formerly known as Pulse Connect Secure. An attacker who hasn’t logged in can exploit it remotely, with no user interaction, to run commands on the appliance.
Affected versions are 22.8R2.4 and earlier, 25.1.2.2 and earlier, and 25.1.1.1 and earlier. Shadowserver tracks more than 5,500 Connect Secure appliances exposed to the internet.
The attacker chains CVE-2026-104935 with two other vulnerabilities to run code as root, even on appliances that were fully patched at the time. Ivanti has fixed two of the three flaws, but it is still working on a fix for a privilege escalation flaw used in the same chain. The attacker installed no malware or web shell. Instead, they exploited the appliance again for every command they wanted to run, then tampered with the logs to hide their activity. Because of this, Ivanti’s Integrity Checker Tool did not detect the compromise. A clean result from that tool is therefore not proof that an appliance is safe.
If GajIPS detects exploitation attempts against an Ivanti Connect Secure appliance in your network: