Ivanti Connect Secure flaw exploited in wild
Free public brief. The indicators, the detections with Splunk SPL already written (plus Elastic and KQL where they apply), and a Slack alert the next time this touches a vendor you run are in the app — free account, no card.
CERT-FR warns Ivanti Connect Secure vulnerability CVE-2026-104935 is actively exploited, enabling remote code execution and privilege escalation.
CERT-FR has issued an advisory covering multiple vulnerabilities across several Ivanti products: Connect Secure (ICS), Neurons for UEM, and Xtraction. The flaws collectively allow data integrity and confidentiality breaches, security policy bypass, remote code execution, and privilege escalation. Ivanti has confirmed that CVE-2026-104935, affecting Connect Secure, is being actively exploited in the wild, making it the most urgent item in this bulletin for organizations running affected versions.
Affected versions include Connect Secure 22.8Rx prior to 22.8R2.5, 25.1.1.x prior to 25.1.1.2, and 25.1.3.x prior to 25.1.3.1. Neurons for UEM was patched automatically on September 16, 2026, while Xtraction versions prior to 2026.4 are also affected by multiple CVEs. CERT-FR references Ivanti's own security bulletins published October 13, 2026, covering the October 2026 security update, the Connect Secure advisory for CVE-2026-104935, the Neurons/Intune patch advisory, and the Xtraction multi-CVE advisory.
Defenders running Ivanti Connect Secure, Neurons for UEM, or Xtraction should prioritize patching to the fixed versions referenced in Ivanti's bulletins, with particular urgency for Connect Secure given the confirmed active exploitation of CVE-2026-104935. Organizations should review Ivanti's advisories for indicators of compromise and apply updates as soon as possible given Ivanti Connect Secure's history as a target for edge-device exploitation.
Mentioned in this report
Source reporting: https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-1311
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), the actors and CVEs it names as live profiles, and the vendor research on the same campaign — the primary source the news paraphrased, cited and read directly.
It sits in a corpus of 13,854 reports from 146 sources, 614 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Name the vendors you run and Slack hears about the reports that touch them — about forty a week that are yours, not the four hundred that are not.
Create a free account What it costs