Skip to contentistheinternetok
All incidents

Security flaw·Critical

Ivanti Connect Secure VPN: zero-day under attack

Fix availableAttackers already use itAffects website owners
Ivanti Connect Secure

What it changes for you

Nothing visible for you; company IT teams must update their VPN.

Hackers were breaking into Ivanti Connect Secure, a VPN that companies use for remote access, before a fix existed. Employees have nothing to do; IT teams must update.

Started Oct 13, 2026Updated Oct 13, 2026

Post on X

What should I do?

You
Nothing to do.
If you run a website or an app
Upgrade Ivanti Connect Secure to the fixed version from Ivanti's advisory (versions 22.8R2.4 and earlier, 25.1.2.2 and earlier, 25.1.1.1 and earlier are affected) and check appliances for signs of compromise.

What is affected

CVE-2026-104935

Timeline

  1. Fix available · Oct 13, 2026

    CISA adds CVE-2026-104935 to its Known Exploited Vulnerabilities catalog.

    CISA

  2. Fix available · Oct 13, 2026

    Ivanti discloses CVE-2026-104935, an authentication bypass in Connect Secure, and says it is aware of limited exploitation in the wild. Volexity reports exploitation since at least October 3.

    BleepingComputer

Sources