Ivanti Connect Secure flaws exploited in wild
CERT-FR warns three Ivanti Connect Secure vulnerabilities are actively exploited, enabling remote code execution, privilege escalation and security bypass.
Sourcecert.cyber.gouv.fr — open the original
What to check
- Applies to
- The 3 CVEs named below. Whether you run an affected version is not assessed: check the versions the source lists.
- Exploitation
- CISA lists CVE-2026-104935, CVE-2026-111357, and CVE-2026-118527 as exploited in the wild.
CERT-FR issued an advisory covering multiple vulnerabilities in Ivanti Connect Secure (ICS) affecting versions 22.8Rx prior to 22.8R2.6, 25.1.1.x prior to 25.1.1.3, and 25.1.2.x prior to 25.1.3.1. The flaws allow an attacker to achieve remote code execution, privilege escalation, and bypass of security policy controls. Ivanti has confirmed that three of the disclosed CVEs — CVE-2026-104935, CVE-2026-111357, and CVE-2026-118527 — are being actively exploited in the wild, prompting a related CERT-FR alert (CERTFR-2026-ALE-013) issued the same day as Ivanti's security bulletin (13 October 2026).
Ivanti notes that version 25.1.3.x is not affected by CVE-2026-111357 and CVE-2026-118527, implying it remains vulnerable to CVE-2026-104935 unless separately patched. Given Ivanti Connect Secure's role as an enterprise VPN/remote access gateway and its history as a high-value target for sophisticated threat actors, active exploitation of these flaws represents a significant risk to any organization running affected versions.
Defenders should prioritize patching to the fixed versions referenced in Ivanti's advisory immediately, given confirmed in-the-wild exploitation. Organizations unable to patch immediately should review Ivanti's guidance for interim mitigations and monitor ICS appliances for indicators of compromise, unauthorized configuration changes, or anomalous authentication activity consistent with RCE or privilege escalation attempts.
Mentioned in this report
Source reporting: https://www.cert.cyber.gouv.fr/avis/CERTFR-2026-AVI-1442
Free public brief. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them, no card.
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 16,445 reports from 149 sources, 666 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.
Create a free account What it costs