Skip to main content
A Singapore Government Agency Website How to identify
Official website links end with .gov.sg
Secure websites use HTTPS
Look for a lock () or https:// as an added precaution. Share sensitive information only on official, secure websites.
Government officials will never ask you to transfer money or disclose bank log-in details over a phone call.

Call the 24/7 ScamShield Helpline at 1799 if you are unsure if something is a scam.

Cyber Security Agency of Singapore
Alerts

Active Exploitation of Vulnerability in Ivanti Connect Secure

20 October 2026

Attackers are exploiting a high-severity vulnerability in Ivanti Connect Secure to execute arbitrary commands. Patch immediately.

Background

Ivanti has released security updates to address a high-severity vulnerability (CVE-2026-104935) affecting Ivanti Connect Secure. This vulnerability has a Common Vulnerability Scoring System (CVSS v3.1) score of 8.6 out of 10.

Impact

Successful exploitation of the authentication bypass vulnerability could allow a remote, unauthenticated attacker to execute arbitrary commands.

Known Exploitation

This vulnerability is reportedly being actively exploited.

Affected Products

The vulnerability affects the following products:

  • Ivanti Connect Secure versions 25.1.1.1 and prior 

  • Ivanti Connect Secure versions 25.1.2.2 and prior  

  • Ivanti Connect Secure versions 22.8R2.4 and prior

Recommendations

Users and administrators of affected products are advised to update to the latest versions immediately.

References 

https://hub.ivanti.com/s/article/Security-Advisory-Ivanti-Connect-Secure-CVE-2026-104935 (opens in new tab)

https://nvd.nist.gov/vuln/detail/CVE-2026-104935 (opens in new tab)    

https://www.volexity.com/blog/2026/10/13/a-series-of-unauthenticated-events-chained-exploitation-of-ivanti-connect-secure-zero-days/ (opens in new tab)

https://www.bleepingcomputer.com/news/security/cisa-warns-admins-to-immediately-fix-ivanti-flaw-exploited-as-zero-day/ (opens in new tab)