Patch todayIvanti Connect SecureFirewalls, VPNs & network gear

An Ivanti VPN flaw lets attackers in without a password

Who's affected: Organizations using Ivanti Connect Secure for remote access. Version 22.7R2.14 and earlier aren't affected.
Under attack?: Yes. Ivanti says a limited number of customers were hit before the fix came out.
What to do: Upgrade Connect Secure to the fixed version.
Fixed in: 25.1.3.0 or later
CISA deadline: Federal agencies must fix this by Oct 16, 2026. Everyone else should treat that as a ceiling, not a target.

CVE-2026-104935Severity score 8.6/10Chance of attack in 30 days: 87% (EPSS)Listed Oct 13, 2026Source: Security Affairs ↗

Client notice ready to send

Fill in the bracketed parts, then paste into an email to your clients or team.

Subject: Security update: Ivanti Connect Secure

Hi [Client name],

Attackers are actively exploiting a security flaw in Ivanti Connect Secure.

Who's affected: Organizations using Ivanti Connect Secure for remote access. Version 22.7R2.14 and earlier aren't affected.

What we're doing: [We're checking your systems now and will have the fix in place by DATE.]

What to do: Upgrade Connect Secure to the fixed version.

Fixed in: 25.1.3.0 or later
Reference: CVE-2026-104935 – https://securityaffairs.com/?p=200887

We'll confirm once everything is updated. Reply here with any questions.

[Your name]

An Ivanti VPN flaw lets attackers in without a password

Also under attack in Firewalls, VPNs & network gear