This report was translated by AI; nobody has reviewed the translation yet. Original language: Slovak.

[TLP:CLEAR] Ivanti Connect Secure fixes an actively exploited vulnerability

Ivanti fixes an actively exploited vulnerability in Ivanti Connect Secure in versions 25.1.1.2, 25.1.3.0, 25.1.3.1 and 22.8R2.5 [1].

Ivanti Connect Secure - RCE (CVE-2026-104935)
CVSS 8.6 (High)

Allows an unauthenticated remote attacker, due to a mismatch between the URL used for authorization and the actual target of the request combined with a race condition between the execution and deletion of an uploaded script, to execute arbitrary code with "cgi-server" privileges [1][2]. This vulnerability can be chained with another vulnerability to escalate privileges from "cgi-server" to root, and no fix exists for that vulnerability yet [2]. Both Ivanti and CISA warn of active exploitation of the vulnerability [1][3]. Details can be found at [2].

The vulnerability is present in product:

  • Ivanti Connect Secure; >=25.1.1.0, <25.1.1.2; >=25.1.2.0, <25.1.3.0; >=22.8R2.0, <22.8.R2.5;

CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L

More information:

The vulnerability was publicly disclosed 13. 10. 2026.

By CESNET, z.s.p.o. Martin Krajči on 15. 10. 2026.

CESNET, z.s.p.o. Logo