{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/connect-secure-25.1.2.2-and-older/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:ivanti:connect_secure:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":8.6,"id":"CVE-2026-104935"}],"_cs_exploited":true,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Connect Secure (22.8R2.4 and older)","Connect Secure (25.1.1.1 and older)","Connect Secure (25.1.2.2 and older)","Connect Secure"],"_cs_severities":["critical"],"_cs_tags":["vulnerability","rce","network-appliance"],"_cs_type":"threat","_cs_vendors":["Ivanti"],"content_html":"\u003cp\u003eIvanti has disclosed a critical zero-day vulnerability, CVE-2026-104935, affecting Ivanti Connect Secure, a solution used to provide remote access to organizational systems and applications. The vulnerability allows an unauthenticated, remote attacker to execute arbitrary commands on the appliance without the need for valid credentials. Ivanti has assigned a CVSS score of 8.6 to this vulnerability. The Netherlands National Cyber Security Centre (NCSC) and Ivanti have confirmed that this vulnerability is being actively exploited by malicious actors in the wild to gain unauthorized access to target organizations. Due to the nature of the appliance providing network-level access, successful exploitation significantly compromises the security of downstream internal systems. Organizations are advised to verify their current version and apply security patches immediately. Because the vulnerability allows for persistent unauthorized control, patching alone is insufficient if the system has already been compromised; incident response procedures must be followed if intrusion is suspected.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eThe vulnerability allows for full system control by unauthorized actors, potentially leading to widespread data exfiltration, lateral movement within the network, and the deployment of additional malicious tools. The vulnerability is being exploited in the wild against a limited number of customers. The NCSC classifies both the risk of exploitation and the potential damage as high.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eIdentify the current version of Ivanti Connect Secure and verify it against the patches listed by Ivanti.\u003c/li\u003e\n\u003cli\u003eApply the relevant security update immediately. For the 22.8 series, update to 22.8R2.5 or migrate to the 25.1 branch (25.1.1.2 or newer). For the 25.1 series, update to 25.1.1.2, 25.1.2.2 (if supported by migration path), or 25.1.3.0/25.1.3.1.\u003c/li\u003e\n\u003cli\u003eInitiate incident response procedures if unauthorized access is suspected, as patching does not remediate established backdoors or persistence.\u003c/li\u003e\n\u003cli\u003eMonitor logs for unusual authentication activity or unexpected process execution occurring on the Connect Secure appliance.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-13T17:36:33Z","date_published":"2026-10-13T16:47:01Z","id":"https://feed.craftedsignal.io/briefs/2026-10-ivanti-connect-secure-rce/","summary":"An unauthenticated remote code execution vulnerability (CVE-2026-104935) in Ivanti Connect Secure is being actively exploited in the wild, enabling attackers to gain control over affected systems.","title":"Remote Code Execution Vulnerability in Ivanti Connect Secure","url":"https://feed.craftedsignal.io/briefs/2026-10-ivanti-connect-secure-rce/"}],"language":"en","title":"CraftedSignal Threat Feed - Connect Secure (25.1.2.2 and Older)","version":"https://jsonfeed.org/version/1.1"}