Security alert for Tampa Bay businesses. A high-severity flaw in Ivanti Connect Secure network appliances is being actively exploited, and U.S. federal agencies have been directed to patch it. If your organization — or the managed IT provider you rely on — runs Ivanti Connect Secure, treat this as urgent.
What CVE-2026-104935 Is
CVE-2026-104935 is an authentication bypass by spoofing in Ivanti Connect Secure. According to the U.S. National Vulnerability Database (NVD), the flaw allows a remote unauthenticated attacker to execute arbitrary commands on affected versions. NVD published it on October 13, 2026.
In plain terms: Ivanti Connect Secure is a network appliance many businesses use for secure remote access — VPN, remote-worker, and site-to-site connectivity. This flaw can let an attacker, without any credentials and without any user interaction, gain access and run commands on the appliance, potentially compromising the devices and people behind it.
The Risk, in Numbers
NVD scores CVE-2026-104935 at 8.6 out of 10 — HIGH severity, with a network attack vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L). That combination — reachable over the network, no privilege or click required, high impact on confidentiality — is why it is rated HIGH and moved to the front of the patch queue.
It Is Being Actively Exploited
CISA has added CVE-2026-104935 to its Known Exploited Vulnerabilities (KEV) catalog, the list of flaws that adversaries are already using in the wild. A KEV listing means the flaw is in active use, not theoretical.
Who Is Affected
Per the NVD record, the flaw affects Ivanti Connect Secure on versions before 25.1.3.0 — including the 25.1.0.0 to 25.1.1.2 range, the 25.1.2.0 to 25.1.3.0 range, and the 22.8 R2 (r2, r2.1, r2.2, r2.3, r2.4) series. NVD notes it does not affect Ivanti Connect Secure 22.7 R2.14 or earlier. Confirm your exact build against the vendor advisory.
What To Do Now
1. If you run Ivanti Connect Secure, update to version 25.1.3.0 or the fixed build Ivanti specifies in its security advisory before the appliance is exposed to the internet.
2. If your managed IT provider operates the appliance, ask them directly for its current build and patch status — many small and medium businesses do not see these devices on their own dashboards.
3. Watch the NVD and CISA entries; exploitation of this class of flaw can spread quickly once it is public.
Questions About This Alert
Is this a remote attack? Yes — the NVD vector marks the attack vector as network (AV:N), with no privileges and no user interaction required.
Why is it on the KEV list? CISA adds a vulnerability to the KEV catalog when adversaries are actively using it, so a listing means the flaw is in use, not theoretical.
Does it affect my network even if I do not run Ivanti? If you do not run Ivanti Connect Secure, and a managed provider does not run it for you, this specific flaw does not apply to you. The risk is to any device that does.
Sources: NVD — CVE-2026-104935 · CISA Known Exploited Vulnerabilities catalog · Ivanti security advisory.
Virtual IT Group runs a cybersecurity readiness check for Tampa Bay businesses — confirming which appliances and systems you run, whether they are patched, and what to close first. Request a security check for your business.
By Marcus Webb, Cybersecurity Analyst, Virtual IT Group · Last updated November 2, 2026
AI-assisted