# Ivanti Connect Secure flaw exploited in wild

Published: 2026-10-14 · Severity: high · Sectors: technology
Canonical: https://vorant.io/reports/f998008b-40ab-5626-9629-1afb898914d9/ivanti-connect-secure-flaw-exploited-in-wild

> CERT-FR warns Ivanti Connect Secure vulnerability CVE-2026-104935 is actively exploited, enabling remote code execution and privilege escalation.

CERT-FR has issued an advisory covering multiple vulnerabilities across several Ivanti products: Connect Secure (ICS), Neurons for UEM, and Xtraction. The flaws collectively allow data integrity and confidentiality breaches, security policy bypass, remote code execution, and privilege escalation. Ivanti has confirmed that CVE-2026-104935, affecting Connect Secure, is being actively exploited in the wild, making it the most urgent item in this bulletin for organizations running affected versions.

Affected versions include Connect Secure 22.8Rx prior to 22.8R2.5, 25.1.1.x prior to 25.1.1.2, and 25.1.3.x prior to 25.1.3.1. Neurons for UEM was patched automatically on September 16, 2026, while Xtraction versions prior to 2026.4 are also affected by multiple CVEs. CERT-FR references Ivanti's own security bulletins published October 13, 2026, covering the October 2026 security update, the Connect Secure advisory for CVE-2026-104935, the Neurons/Intune patch advisory, and the Xtraction multi-CVE advisory.

Defenders running Ivanti Connect Secure, Neurons for UEM, or Xtraction should prioritize patching to the fixed versions referenced in Ivanti's bulletins, with particular urgency for Connect Secure given the confirmed active exploitation of CVE-2026-104935. Organizations should review Ivanti's advisories for indicators of compromise and apply updates as soon as possible given Ivanti Connect Secure's history as a target for edge-device exploitation.

## Mentioned in this report

- Vulnerabilities: CVE-2026-104935 (KEV), CVE-2026-106034, CVE-2026-106035, CVE-2026-106042, CVE-2026-106043, CVE-2026-106047, CVE-2026-109412

Source reporting: https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-1311

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/f998008b-40ab-5626-9629-1afb898914d9/ivanti-connect-secure-flaw-exploited-in-wild.
In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), live profiles of the actors and CVEs it names, and the vendor research on the same campaign. Slack alerts fire on the vendors, sectors and countries a reader follows. A new account starts with three days of all of it, no card: https://vorant.io/signup