Version 25.1.3.0 of Ivanti Connect Secure came out in July and does not contain this week's flaw. But it needs Ivanti's new platform. The problem is for everyone still running something else.
Ivanti admits it in its own advisory, no dodging. The company writes that it found part of the flaw itself, in its product security program, and patched it in the July release. The fix for the other supported versions was still being backported when exploitation occurred. How many customers are affected isn't stated beyond a limited number. Who is attacking isn't either.
Fact
The facts: on 13 October 2026 Ivanti published an advisory for CVE-2026-104935 in Ivanti Connect Secure (ICS) - an authentication bypass by spoofing that allows a remote unauthenticated attacker to execute arbitrary commands. Ivanti rates it 8.6 (High) on CVSS, weakness CWE-290. Affected are 25.1.1.1 and earlier, 25.1.2.2 and earlier, and 22.8R2.4 and earlier; version 22.7R2.14 and earlier are not affected. The fixed versions are 25.1.1.2, 25.1.3.0, 25.1.3.1 and 22.8R2.5. Version 25.1.3.0 dates from July 2026 and requires the new platform (ISA4500, ISA6500 or ISA8500). Ivanti says it is aware of exploitation affecting a limited number of customers at the time of disclosure, and thanks Volexity. The same day, 13 October, CISA added the flaw to its Known Exploited Vulnerabilities (KEV) catalog with a deadline of 16 October for US federal civilian agencies. With that deadline and on the same day, CISA also added CVE-2026-96951 in Windows Shell: according to NVD, a command injection that allows an unauthorized attacker to bypass a security feature over a network. Microsoft rates it 8.8 (High) on CVSS. For both, the catalog, under directive BOD 26-04, also requires a forensic triage to check whether the system is already compromised.
The dates in the advisory show how the backporting went. 25.1.1.2 is from 5 October, 22.8R2.5 from 12 October. The advisory is from the 13th.
A fix for the new platform doesn't protect whoever is still on the old one.
Windows is the quieter half of the day. Affected versions run from Windows 10 and Windows Server 2012 R2 up to Windows 11 26H2 and Server 2025, and Microsoft's vector says user interaction is required. I couldn't open Microsoft's advisory. So for Windows we know two things: what NVD says, and that CISA listed it as exploited. How it is exploited, and by whom, isn't in the sources I checked.
On Connect Secure the version comes first. On the old platform the fix is 25.1.1.2, and on 22.8, if you can't move to 25.1 right away, also 22.8R2.5. The 22.8 line reaches end of life on 31 January 2027 anyway, and Ivanti wants the migration to 25.1 done by then. The version doesn't tell you whether someone has already been inside, though. For that Ivanti offers the Integrity Checker Tool and advises running it regularly: for now there are few indicators of compromise.
Sources
Ivanti Security Advisory (CVE-2026-104935), 13.10.2026NVD - CVE-2026-104935NVD - CVE-2026-96951CISA KEV (CVE-2026-104935, CVE-2026-96951)The visual is generated code-art, no third-party images.