Ivanti Connect Secure: patching CVE-2026-104935 and investigating earlier compromise

What it is

Status as of 25 October 2026. CVE-2026-104935 is an authentication bypass permitting unauthenticated command execution in Ivanti Connect Secure. This article uses CISA's alert and Ivanti's security updates dated 13 October 2026. Re-check the vendor bulletin, hardware-compatible upgrade paths and the separate privilege-escalation fix before remediation. Ivanti's October update still described that additional fix as forthcoming; this article does not claim the entire reported chain is fixed. Ivanti update.

Why it matters

CISA reports credential theft and data exfiltration and confirms the vulnerability entered its Known Exploited Vulnerabilities catalogue on 13 October 2026. Commands can execute in memory, so an Integrity Checker Tool (ICT) result cannot exclude exploitation. Network and memory forensics are needed to investigate that possibility. CISA alert.

Ivanti's older ICT explanation distinguishes file-integrity comparisons from malware detection: the external package compares version-specific files and hashes, and internal and external checks supplement continuous monitoring. That historical guidance explains the tools; its old incident-specific patch instructions are not the recovery instructions for this vulnerability. ICT FAQ.

How to apply

• Record each appliance's installed code line and exposure. CISA lists 25.1.1.1 and prior, 25.1.2.2 and prior, and 22.8R2.4 and prior in the affected lines. Do not turn these branch-specific statements into one numeric range across every release.
• Select a compatible fix. Ivanti lists 25.1.1.2, 25.1.3.0, 25.1.3.1 and 22.8R2.5, depending on the code line. Confirm the appliance's supported migration path before choosing an image. These are fixes for this CVE, not a declaration that every vulnerability is resolved. Vendor release summary.
• Preserve evidence with the incident-response team before disruptive recovery. Where Neurons for Secure Access manages the gateway, use Administration > Tenant Logs to review administrator and event records and export them. Record unexplained upgrades, configuration changes and reboots for investigation. The documented log-export control is Export Logs. Administration guide.
• Run the applicable internal ICT and current external ICT. In the same management service, select Administration > Integrity Checker Tool, select the gateway, then Scan now. Save the report and available snapshot. Confirm a scan actually completed; an empty scan history is not a clean result. Ask support to interpret anomalies.
• If compromise is suspected, follow CISA's recovery sequence: back up configuration, factory-reset the hardware or rebuild the virtual/cloud instance, upgrade, and restore configuration. Reset domain, administrator and local-account passwords; revoke and reissue stored certificates; replace stored API keys and license-server credentials. Recovery guidance.
• After recovery, verify the installed release, repeat applicable integrity checks, and continue network monitoring and log review. Ivanti explicitly treats patching as one part of continuing appliance-integrity validation. Security update.

Pitfalls

An integrity anomaly needs investigation, while a clean scan cannot establish historical innocence. Keep the forensic conclusion separate from the upgrade record. Do not reuse patch or reset instructions from an older Ivanti incident without checking the current advisory and deployment type.