Skip to main content
The Website Services team at NHS England are testing early designs to understand how you find information. Your views will help us check our ideas work. Sign up to take part in our user research.

Ivanti Releases Security Updates for Connect Secure

CVE-2026-104935 may allow unauthenticated remote code execution on affected Ivanti Connect Secure appliances

Threat ID:
CC-4866
Threat Severity:
Medium
Published:
13 October 2026 4:43 PM
Report a cyber attack: call 0300 303 5222 or email [email protected]

Summary

CVE-2026-104935 may allow unauthenticated remote code execution on affected Ivanti Connect Secure appliances

Threat details

Exploitation in the wild

Ivanti has observed exploitation in the wild affecting a limited number of customers at the time of disclosure when CVE-2026-104935, CVE-2026-111357 and CVE-2026-118527 are chained.  

The NHS England National CSOC assesses further exploitation as highly likely.

Introduction

Ivanti has released a security advisory to address three vulnerabilities in Ivanti Connect Secure.

  • CVE-2026-104935 - 'Authentication Bypass by Spoofing' vulnerability - CVSSv3.0 Score: 8.6. 
  • CVE-2026-111357 - 'Inclusion of Functionality from Untrusted Control Sphere' vulnerability - CVSSv3.0 Score: 8.6.
  • CVE-2026-118527 - 'Generation of Predictable Numbers or Identifiers' vulnerability - CVSSv3.0 Score: 4.3.

Threat updates

Date Update
30 Oct 2026 Exploitation in the wild

Updated the follow to reflect exploitation in the wild

  • Affected platform
  • Red box
  • Introduction

Remediation advice

Affected organisations are encouraged to review Ivanti advisory Security Advisory Ivanti Connect Secure (CVE-2026-104935) and apply the relevant update as soon as possible.

Last edited: 30 October 2026 12:04 pm