Tracked as CVE-2026-104935 and rated at CVSS 8.6 out of 10, the vulnerability affects multiple product branches, including Ivanti Connect Secure 22.8R2.4 and earlier, as well as specified 25.1 releases. Ivanti says versions 22.7 and earlier are not affected.
Ivanti has released fixes, including for versions 22.8R2.5, 25.1.1.2, 25.1.3.0, and 25.1.3.1, depending on the hardware and software branch. Security teams were advised to identify their deployed versions, apply corresponding fixes, and investigate potential compromise.
While Ivanti said reliable indicators of compromise were not yet available, Volexity, the cybersecurity firm credited with discovering the flaw, has published details of its exploitation. The US Cybersecurity and Infrastructure Security Agency added the flaw to its known exploited vulnerabilities (KEV) catalog on October 13.
