Ivanti Patching Is Not Clearance
On 13 October, Ivanti reported limited exploitation of Connect Secure’s CVE-2026-104935. The 8.6 High flaw allows unauthenticated command execution.
Select the fixed branch
| Affected branch | Fixed build |
|---|---|
| 25.1.1.1 and earlier: physical ISA6000/ISA8000; virtual ISA4000/ISA6000/ISA8000 | 25.1.1.2 (5 October) |
| 25.1.2.2 and earlier | 25.1.3.0 (July) or 25.1.3.1 |
| 22.8R2.4 and earlier | 22.8R2.5 (12 October) |
22.7R2.14 and prior are excluded; 22.7/22.8 support ends on 31 January 2027.
Volexity describes patch publication on 13 October; Ivanti’s build dates differ.
The appliance determines the route
The compatibility guide distinguishes factory hardware from older physical and virtual deployments. 25.1.2.1 is ISA6500 hardware-only; 25.1.2.2 is ISA6500/ISA8500 hardware-only. Those eligible systems can upgrade directly to 25.1.3.0. The older models in the table require migration for that destination. New virtual deployments need the destination image.
Direct cluster upgrades from 22.8R2 to 25.x are unsupported: break the cluster, upgrade members individually and recreate it. Check the exact source build before choosing a route.
A patch target and a migration destination are different decisions. Change approval should name the intended route, its effect on service availability and the post-change build verification.
Investigate the exposure window
Volexity traced activity to 3 October on then-patched 22.8R2.4 Build 19097. The attackers targeted credentials, restored changes and deleted logs. A separate privilege-escalation step gave root access; its fix remains forthcoming. A clean integrity check cannot exclude this chain.
Ivanti recommends checks; indicators are limited.
Verify the running build for the change. Separately retain exposure-window evidence and name an investigation owner. Do not discard evidence because the upgrade succeeded.
Read the deadline in its proper scope
The CISA catalogue added the flaw on 13 October, lists 16 October as the due date and requires forensic triage. Ransomware use is unknown.
BOD 26-04 applies to in-scope US Federal Civilian Executive Branch systems, not every organisation. Contractor obligations depend on the governing procurement contract; agencies must review contracts for changes needed to comply. Other operators should treat confirmed exploitation as a prioritisation signal without describing the catalogue date as their universal legal deadline.
The recovery page requires sign-in. Its restricted procedures are not reproduced here. Keep collection and recovery within your authorised incident-response process.
