Ivanti security advisory (AV26-1035)

CVE-2026-104935 is an authentication bypass by spoofing (CWE-290) in Ivanti Connect Secure. A remote, unauthenticated attacker can spoof authentication on affected gateways and then execute arbitrary commands. Impact is high confidentiality loss with lower integrity and availability impact (CVSS 3.1 base 8.6; network, low complexity, no privileges or user interaction). It affects Connect Secure builds before 25.1.3.0 and does not affect 22.7R2.14 or earlier. CISA added it to the Known Exploited Vulnerabilities catalog on 2026-10-13 after reported zero-day attacks; ransomware use is listed as unknown, public proof-of-concept references exist, and EPSS is about 26% (98th percentile).

Do: Upgrade Ivanti Connect Secure to 25.1.3.0 or later. Builds at 22.7R2.14 and earlier are not affected. Because this is in CISA’s KEV catalog, apply the vendor’s mitigations, follow BOD 26-04 and CISA forensics-triage guidance, and treat internet-exposed appliances as potentially compromised until reviewed.

CVE-2026-109412 is an exposed dangerous endpoint (CWE-749) in Ivanti Neurons Patch for Intune. A remote attacker who already has low-privilege authentication can reach the endpoint over the network with no user interaction and leak sensitive authentication information. The CVSS 3.1 score is 9.9 (critical) with changed scope and high impact to confidentiality, integrity, and availability, so stolen credentials could be reused against systems beyond the vulnerable component. Organizations that run Ivanti Neurons Patch for Intune are affected; the source data does not name a version range. There is no known public proof-of-concept and the issue is not listed in CISA KEV.

Do: Apply the vendor fix for Ivanti Neurons Patch for Intune as soon as a patched release is identified, and until then restrict network access to the product so only trusted administrators can reach it. Rotate any authentication material that may have been exposed through the endpoint and review access logs for unexpected authenticated calls. Do not wait for a public proof-of-concept; the CVSS score indicates leaked credentials could affect systems beyond the patch component.