Ivanti Connect Secure CVE-2026-104935 (authentication bypass to command execution, exploited as a zero-day, CISA KEV): which versions fix it?

Am I affected? Yes if you run Ivanti Connect Secure (ICS) on: - 22.8R2.4 or earlier on the 22.8 line - 25.1.1.1 or earlier on the 25.1.1 line - 25.1.2.2 or earlier on the 25.1.2 line Versions 22.7.x and below are reported as not affected. Ivanti disclosed it on October 13, 2026. Attacks started around October 3, before disclosure, and CISA added it to the KEV catalog the same day. Researchers saw it chained with a separate privilege escalation to root that has no CVE or fix yet. So patching closes the way in, but it doesn't clean up a box that was already compromised. How to check: - The version is shown in the admin console (System > Maintenance > Platform / the header of the admin UI). Fix: upgrade on an emergency basis: - 22.8 line -> 22.8R2.5 (or move to 25.1.1.2) - 25.1.1 line -> 25.1.1.2 - 25.1.2 line -> 25.1.3.0 or 25.1.3.1 Interim mitigation: - If you can't patch immediately, limit access to the appliance's user and admin interfaces to the source ranges you need, and keep the admin interface off the internet entirely. After patching (assume compromise if exposed since early October): - Run Ivanti's external Integrity Checker Tool and review the results, and follow Ivanti's advisory for anything it flags (typically a factory reset and rebuild from a clean image). - Review logs for unexpected logins, new admin accounts and configuration changes. - Rotate credentials the appliance handled or stored: local admin passwords, service accounts used for LDAP/AD binding, certificates and API keys. Reset passwords for users who authenticated through it if compromise is confirmed. - Watch for Ivanti's fix for the separate privilege escalation and apply it when it ships. Sources: https://www.rapid7.com/blog/post/etr-ivanti-connect-secure-zero-day-exploited-in-the-wild-cve-2026-104935/ https://itdaily.com/news/business/ivanti-bug-ics-2026/ https://pasqualepillitteri.it/en/news/23831/ivanti-connect-secure-zero-day-exploited-patch-vpn-now