Full Report
Ivanti security advisory (AV26-1035)
Analysis Summary
# Vulnerability: Multiple Vulnerabilities in Ivanti Products (October 2026)
## CVE Details
- **CVE ID:** CVE-2026-104935 (Primary), CVE-2026-109412
- **CVSS Score:** Critical (Assumed based on KEV status and product types)
- **CWE:** Not specified in the advisory.
## Affected Systems
- **Products:**
- Ivanti Connect Secure
- Ivanti Neurons Patch for Intune
- Ivanti Xtraction
- **Versions:**
- **Connect Secure:** 25.1.1.1 and prior; 25.2.2 and prior; 22.8R2.4 and prior.
- **Neurons Patch for Intune:** Versions prior to September 16, 2026.
- **Xtraction:** Version 2026.2.1 and prior.
- **Configurations:** Default installations of the affected versions.
## Vulnerability Description
While the specific technical mechanism (e.g., Buffer Overflow, SQLi) is not detailed in the high-level bulletin, these vulnerabilities involve remote security flaws that allow for unauthorized access or system compromise. CVE-2026-104935 specifically impacts the Connect Secure gateway, a critical perimeter security component.
## Exploitation
- **Status:** **Exploited in the wild.** CVE-2026-104935 has been added to the CISA Known Exploited Vulnerabilities (KEV) Database.
- **Complexity:** Low (Based on KEV inclusion for automated/wide-scale exploitation).
- **Attack Vector:** Network.
## Impact
- **Confidentiality:** High
- **Integrity:** High
- **Availability:** High
## Remediation
### Patches
- **Ivanti Connect Secure:** Administrators should upgrade to the latest patched releases provided in the Ivanti portal (Specific patch version numbers vary by release branch).
- **Ivanti Xtraction:** Apply the latest security updates released post-October 13, 2026.
- **Ivanti Neurons Patch for Intune:** Update to the version released on or after September 16, 2026.
### Workarounds
- No specific workarounds were provided in the bulletin; Ivanti recommends immediate patching for products listed on the CISA KEV.
## Detection
- **Indicators of compromise:** Organizations should monitor for unusual administrative logins or unauthorized configuration changes on Connect Secure appliances.
- **Detection methods and tools:** Review CISA KEV guidance and use Ivanti’s internal Integrity Checker Tool (ICT) where applicable to verify system file integrity.
## References
- hxxps[://]hub[.]ivanti[.]com/s/article/Security-Advisory-Ivanti-Connect-Secure-CVE-2026-104935
- hxxps[://]hub[.]ivanti[.]com/s/article/Security-Advisory-Ivanti-Xtraction-Multiple-CVEs
- hxxps[://]hub[.]ivanti[.]com/s/article/Security-Advisory-Ivanti-Neurons-Patch-for-Intune-October-2026
- hxxps[://]www[.]cisa[.]gov/known-exploited-vulnerabilities-catalog
- hxxps[://]www[.]cyber[.]gc[.]ca/en/alerts-advisories/ivanti-security-advisory-av26-1035