# Ivanti Connect Secure flaws exploited in wild

Published: 2026-11-02 · Severity: severe · Sectors: Technology, Government (National)
Canonical: https://vorant.io/reports/4aa70efe-9600-53f9-81c2-7183d9d8f32e/ivanti-connect-secure-flaws-exploited-in-wild
Vorant's rating weighs the evidence in the report: confirmed exploitation, victims claimed, CVSS and EPSS, and how many sources agree. It rates the report, not your assets.

> CERT-FR warns three Ivanti Connect Secure vulnerabilities are actively exploited, enabling remote code execution, privilege escalation and security bypass.

Source: cert.cyber.gouv.fr — https://www.cert.cyber.gouv.fr/avis/CERTFR-2026-AVI-1442

## What to check

- Applies to: The 3 CVEs named below. Whether you run an affected version is not assessed: check the versions the source lists.
- Exploitation: CISA lists CVE-2026-104935, CVE-2026-111357, and CVE-2026-118527 as exploited in the wild.

CERT-FR issued an advisory covering multiple vulnerabilities in Ivanti Connect Secure (ICS) affecting versions 22.8Rx prior to 22.8R2.6, 25.1.1.x prior to 25.1.1.3, and 25.1.2.x prior to 25.1.3.1. The flaws allow an attacker to achieve remote code execution, privilege escalation, and bypass of security policy controls. Ivanti has confirmed that three of the disclosed CVEs — CVE-2026-104935, CVE-2026-111357, and CVE-2026-118527 — are being actively exploited in the wild, prompting a related CERT-FR alert (CERTFR-2026-ALE-013) issued the same day as Ivanti's security bulletin (13 October 2026).

Ivanti notes that version 25.1.3.x is not affected by CVE-2026-111357 and CVE-2026-118527, implying it remains vulnerable to CVE-2026-104935 unless separately patched. Given Ivanti Connect Secure's role as an enterprise VPN/remote access gateway and its history as a high-value target for sophisticated threat actors, active exploitation of these flaws represents a significant risk to any organization running affected versions.

Defenders should prioritize patching to the fixed versions referenced in Ivanti's advisory immediately, given confirmed in-the-wild exploitation. Organizations unable to patch immediately should review Ivanti's guidance for interim mitigations and monitor ICS appliances for indicators of compromise, unauthorized configuration changes, or anomalous authentication activity consistent with RCE or privilege escalation attempts.

## Mentioned in this report

- Vulnerabilities: CVE-2026-104935 (KEV), CVE-2026-111357 (KEV), CVE-2026-118527 (KEV)

Source reporting: https://www.cert.cyber.gouv.fr/avis/CERTFR-2026-AVI-1442

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/4aa70efe-9600-53f9-81c2-7183d9d8f32e/ivanti-connect-secure-flaws-exploited-in-wild.
In the app the same report carries live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out. Slack alerts on the vendors, sectors and countries a reader follows come with the paid plans too. A new account starts with a three-day trial, no card: https://vorant.io/signup