Ivanti Connect Secure: CISA’s due date is 16 October
The catalog, reread on 17 October 2026, is version 2026.10.16, with 1,748 entries. CVE-2026-104935 did not change: due 16 October. The CISA alert, the NVD record and CERT-FR name versions, but not the same bounds. We do not pick one.
Getting started
Generated image · SecuFocus
At a glance
Key points
If you administer Connect Secure, isolate the appliance from the internet and from the internal network. The integrity checker may see nothing. CERT-FR, the CISA alert and the NVD record do not give the same bounds. We have no appliance.
What changes
On 14 October 2026, the JSON feed of the catalog is version 2026.10.13, with 1,741 entries, released on 13 October 2026 at 19:10 UTC. CVE-2026-104935, Ivanti Connect Secure, still has an add date of 13 October and a due date of 16 October 2026. The title calls it an authentication bypass by spoofing. The description says a remote unauthenticated attacker can execute arbitrary commands. The ransomware field says Unknown. Forensic triage says Yes. The named weakness is CWE-290. A reading the same day at 14:34 UTC saw 1,740 entries and forensic triage set to No. The feed now says Yes. On 15 October 2026, the feed is version 2026.10.14, with 1,745 entries, released on 14 October 2026 at 19:27 UTC. CVE-2026-104935 has not changed: same add date, same due date of 16 October, forensic triage still Yes.
The required action says to apply mitigations according to the vendor’s instructions, or to discontinue use if those mitigations are unavailable. It also points to directive BOD 26-04. We did not reread that directive. 16 October is the date written in the catalog. It is not a deadline SecuFocus sets for other readers.
On 16 October 2026, the feed is version 2026.10.15, with 1,746 entries, released on 15 October 2026 at 17:00 UTC. CVE-2026-104935 did not change due date. The 15 October addition is Atlassian, already noted. On 17 October 2026, the feed is version 2026.10.16, with 1,748 entries, released on 16 October 2026 at 17:15 UTC. Two entries were added on 16 October: CVE-2026-102764, BeyondTrust, and CVE-2025-61624, Fortinet. They have their own note. CVE-2026-104935 did not change due date: 16 October is still written on it.
What the catalog says about the product
The CISA alert of 13 October 2026 names Connect Secure 25.1.1.1 and earlier, 25.1.2.2 and earlier, and 22.8R2.4 and earlier. It says threat actors are exploiting the flaw for credential theft and data exfiltration. It also says Ivanti’s integrity checker may not detect the exploitation, because the commands execute in memory. Version 22.8 reaches end of life on 31 January 2027, according to the same alert.
The NVD record, status Analyzed, modified on 13 October 2026 at 19:24 UTC, does not give the same bounds. The English description says ICS before 25.1.3.0, and that this does not affect 22.7R2.14 or earlier. The versions marked unaffected are 25.1.3.0, 25.1.3.1, 22.8R2.5 and 22.7R2.14. The CPE list is narrower: 25.1.0.0 inclusive up to but not including 25.1.1.2, 25.1.2.0 inclusive up to but not including 25.1.3.0, and 22.8 R2, R2.1, R2.2, R2.3, R2.4. We do not pick a safe version between the alert and the record.
The CVSS 3.1 score supplied with the record is 8.6, high. The vector says network, no account, no user action. The CISA coordinator, at 15:42 UTC, marks exploitation active, automatable, technical impact total. That is not a SecuFocus test.
The CERT-FR alert of 14 October 2026, CERTFR-2026-ALE-013, gives yet another set of bounds: 22.8Rx before 22.8R2.5, 25.1.1.x before 25.1.1.2, and 25.1.3.x before 25.1.3.1. It does not name the 25.1.2 branch that the CISA alert cites. It includes a 25.1.3 line, while the NVD record marks 25.1.3.0 and 25.1.3.1 as unaffected. We do not pick one. CERT-FR writes that Ivanti says exploitation is active. It asks to isolate the machine from the internet and from the internal network, to take a snapshot if the appliance is virtual, and to avoid powering it off if the traces need to remain. It says the external integrity checker needs physical access and can interrupt the service.
What we did not check
We did not open the Ivanti vendor page. It is not on the source list we cite. The numbers in the CISA alert and the NVD record do not come from that page. An NVD API query on 13 October 2026, earlier in the day, returned zero records. On 14 October the same API has a record, published on 13 October at 16:17 UTC. On 15 October 2026, CERT-FR has an alert, CERTFR-2026-ALE-013, dated 14 October. It was not on the pages we read the day before. CERT-EU’s homepage, read on 15 October, has no post on this identifier. Exploited comes from the catalog, the CISA alert, and what CERT-FR says it received from Ivanti. It is not a SecuFocus test. Unknown in the ransomware field does not prove a campaign is absent. We have no appliance, and we did not replay the flaw. CERT-FR cites a 13 October report for indicators. We did not open that report: it is not on the list.
The choice
If you administer an Ivanti Connect Secure, the move is still immediate: isolate the appliance from the internet and from the internal network, as the CERT-FR alert asks. Apply the mitigations the vendor documents, or stop using the product. Do not trust the integrity checker alone: the CISA alert says it may see nothing, because the commands execute in memory. CERT-FR adds that the external script needs physical access and can interrupt the service. Do not call a version safe: the CISA alert, the NVD record and CERT-FR do not give the same bounds. If compromise is suspected, CERT-FR says to treat LDAP or Active Directory secrets that passed through the appliance as compromised: it writes that it knows of lateral movement using those secrets. The reset details stay in that alert. They are not copied here. If you do not run this product, this note changes nothing for you. Windows has its own note. So do the four additions of 14 October.
Check and explore
Sources for this article
Numbers connect each reference to the passages that use it. Dates show when the documentation was consulted.
This article draws on the sources above. The exercises are for you to try on your devices; SecuFocus does not present them as tests carried out by its editorial team. Interfaces and features can change. Method and corrections.
Cite this article
Keep this reference with the article when you save or share it.