What happened
A critical vulnerability has been identified in Ivanti Connect Secure that involves a missing authentication for a critical function. This weakness can potentially enable a local authenticated attacker to escalate their privileges within affected deployments. The vulnerability has been actively exploited in the wild, with reports confirming its ongoing exploitation. Exploitation may be chained with other vulnerabilities, specifically CVE-2026-104935 and CVE-2026-118527, increasing the threat level. The flaw is associated with three weaknesses classified as CWE-306, CWE-862, and CWE-345, which relate to security control issues and flaws in authentication mechanisms. Ivanti Connect Secure's susceptibility to this vulnerability has been recognised by CISA KEV, and the affected components are targeted by active exploits. Details about the specific vulnerability characteristics have been shared by authoritative sources, underscoring the importance of prompt mitigation in vulnerable environments.
Who is affected
Organisations running Ivanti Connect Secure are impacted by this vulnerability. The affected deployments include instances exposed to the internet or accessible through unprotected network pathways. Any deployment where the vulnerability can be chained with other weaknesses poses a significant risk, especially if the environment allows for authenticated access. Due to active exploitation, all affected entities with exposure should evaluate their configurations and apply appropriate mitigations. The impact is heightened for those with internet-facing deployments or without adequate security controls around authentication mechanisms.
Recommended actions
- Apply mitigations in accordance with Ivanti vendor instructions. Ensure compliance with CISA’s BOD 26-04 guidance on prioritising security updates based on risk.
- Follow the instructions outlined in CISA’s “Forensics Triage Requirements” to properly evaluate and respond to the vulnerability.
- For cloud-based deployments, follow applicable BOD 26-04 guidelines or consider discontinuing use of the product if mitigations are not available.
- Evaluate the internet exposure of affected deployments and implement controls to limit access where feasible, especially for internet-facing instances.
