CVE-2026-104935 explained: what the Ivanti Connect Secure flaw means for your business

The two-minute check

1. Open the admin console on the computer, phone or server you run Ivanti Connect Secure on.
2. Find the version number. It's usually on the login screen or an About page.
3. Write that version number down before you do anything else.

When you can stop reading

The official record says this bug does not affect Ivanti Connect Secure version 22.7R2.14 or earlier, according to NVD. If your version matches that or is older, you can close this tab. The record describes affected versions as anything before 25.1.3.0, so if your version falls between those two numbers, you are affected. The record doesn't say anything about other Ivanti products, so this guide only covers Connect Secure.

What the official record says

This flaw carries a Common Vulnerability Scoring System (CVSS) score of 8.6, rated HIGH, according to NVD. The scoring details say an attacker needs no account on your system and does not need you to click anything. They only need network access to reach the login screen, and the attack is rated as low-complexity, meaning it doesn't require special timing or luck. Once in, the record says they can read sensitive data and run commands on the system, which is what "arbitrary commands" means in the official description. This bug was added to the Cybersecurity and Infrastructure Security Agency (CISA) Known Exploited Vulnerabilities (KEV) catalog, which only lists bugs CISA has confirmed are being used by attackers right now, according to CISA. The record does not report any known ransomware use tied to this bug.

What that means for a business like yours

Connect Secure is usually the front door for remote staff, so a flaw here can expose everything behind it. An attacker who gets in doesn't need a password, which is unusual and makes this easier to exploit than most. This isn't a reason to panic, but it is a reason to act today rather than next month.

If someone else manages your IT

Send your provider a short, direct message. Here's wording you can paste as-is:

"Please confirm whether we run Ivanti Connect Secure anywhere in our environment. If we do, please tell me the exact version number. Please also confirm what steps you're taking for CVE-2026-104935, which is on the CISA KEV list."

If you manage it yourself

1. Log into the admin console for Ivanti Connect Secure.
2. Confirm the version number against the affected range described above.
3. If you're affected, check the Ivanti advisory for current guidance.
4. Review your access logs for logins you don't recognize.
5. Restrict who can reach the admin interface from the open internet.
6. Consider talking to a cybersecurity provider if this is unfamiliar territory.

The honest answer is now. This bug is already on the CISA Known Exploited Vulnerabilities catalog, meaning criminals are already using it against real systems. Federal agencies have a remediation due date of October 16, 2026, which gives you a sense of urgency even if you're not a federal agency yourself. Waiting a week or a month is not a reasonable option here.

There is no vendor patch for this flaw yet, so "it worked" means your interim steps are actually in place, not that the bug is gone. Log back into the admin console and confirm your access restrictions are still active. Check your logs again for any new suspicious logins since you made changes. When a fix does ship, the record doesn't yet name a version, so check the Ivanti advisory for the version number to confirm against, and match it exactly to what your console shows.

Since there's no fix to install yet, your real options are about reducing exposure, not closing the hole completely. Each step below buys you something specific, and none of them is a substitute for an eventual update.

• Limit who can reach the admin interface from outside your network. This reduces the number of people who can even attempt the attack, but it won't stop someone already inside your network.
• Turn on multi-factor authentication (MFA) everywhere you can on related systems. This slows down an attacker who steals a password elsewhere, though it does not block this specific no-login flaw.
• Increase how often you review access logs. This won't prevent an attack, but it shortens how long one goes unnoticed.
• Ask a provider with managed IT services to monitor the system for you. Automated monitoring can flag unusual activity around the clock, even outside business hours.

Do I have to do anything if we only use this at home?

Yes. The risk doesn't depend on whether the system sits in an office or a home. It depends on whether the software is reachable from the internet and which version it's running.

Will checking my version break anything?

No. Looking at a version number or login screen doesn't change any settings. Restricting admin access or turning on MFA can affect how staff log in, so plan those changes for a quiet time of day.

We handle health records. Does this change our compliance obligations?

A system this exposed is worth reviewing against your HIPAA obligations if you handle health data, or your FTC Safeguards Rule duties if you handle financial data. Neither rule names this specific bug, but both expect you to act on known risks to sensitive systems.

Should we limit who has admin access to this system?

Yes, that's good practice regardless of this specific bug. Fewer admin accounts means fewer ways in if a credential gets stolen, which is part of what privileged access management is built to handle.

How do we know when a real fix is available?

Watch the official advisory for an update, since the record doesn't currently name a fixed version. If you'd rather not watch it yourself, LayerLogix can track it for you as part of ongoing support.

LayerLogix brings 20+ years of experience and 100% Texas-based support to businesses across The Woodlands, Round Rock, Greater Houston, DFW and Austin. If you're not sure whether this affects you, or you want someone else watching for the fix, request a free IT assessment or contact us today.