Critical Remote Code Execution Vulnerability (CVE‑2026‑104935) in Ivanti Connect Secure VPN
What Happened – A newly disclosed flaw (CVE‑2026‑104935) in Ivanti Connect Secure (ICS) allows an unauthenticated attacker to execute arbitrary commands on the gateway. The vulnerability has been observed in the wild and affects all ICS releases prior to 25.1.3.0, 25.1.1.2, and 22.8R2.5.
Why It Matters for Trust & Control Assurance
- Demonstrates the need for a documented, risk‑based vulnerability‑management process that can be shown to auditors as continuous control evidence.
- Highlights the importance of automated patching and regular scanning of public‑facing applications to satisfy control objectives around “Maintain a remediation process” and “Perform automated vulnerability scans.”
- Provides a concrete test case for proving that your organization can detect, assess, and remediate critical flaws before they are exploited.
Who Is Affected – Large and medium government agencies, large and medium enterprises that rely on Ivanti Connect Secure for remote access.
Recommended Actions
- Deploy Ivanti’s patches (ICS 25.1.1.2, 25.1.3.0/1, 22.8R2.5) after appropriate testing.
- Formalize a vulnerability‑management safeguard (documented process, risk‑based remediation, monthly or more frequent patch cycles).
- Run automated vulnerability scans of all internet‑exposed assets at least quarterly and integrate findings into your remediation workflow. Source: CIS Advisory 2026‑115
Technical Notes
- Attack vector: Exploit of a public‑facing SSL VPN component (T1190 – Exploit Public‑Facing Application).
- Impact: Remote code execution in the context of the VPN service; potential for data theft, system compromise, or lateral movement.
- Affected versions: ICS 25.1.1.1‑ and earlier, 25.1.2.2‑ and earlier, 22.8R2.4‑ and earlier. Source: same as above