Ivanti Connect Secure: CERT-FR alert on CVE-2026-104935 — active exploitation

Why CERT-FR raised an alert

On 14 October 2026, France’s CERT-FR escalated to alert level with CERTFR-2026-ALE-013 for Ivanti Connect Secure (ICS). The notice references the vendor bulletin of 13 October 2026 (CVE-2026-104935). The official summary cites arbitrary remote code execution, privilege escalation, and security-policy bypass. Ivanti adds that the flaw is actively exploited—which calls for tighter operational response than a routine patch advisory.

Affected versions and firmware

CERT-FR scope covers Connect Secure (ICS) 22.8Rx before 22.8R2.5, 25.1.1.x before 25.1.1.2, and 25.1.3.x before 25.1.3.1. Documented remediation is firmware upgrade when fixes are available. On the same day, advisory CERTFR-2026-AVI-1311 expands Ivanti’s October 2026 batch (Connect Secure, Xtraction before 2026.4, Neurons for UEM patches auto-deployed on 16 September 2026) with several additional CVEs—worth checking if your estate mixes VPN and Ivanti management tools.

• Inventory all Connect Secure appliances reachable from the Internet or used for employee remote access.
• Match displayed firmware to floors 22.8R2.5, 25.1.1.2, and 25.1.3.1 before closing a ticket.
• Track LDAP/Active Directory service accounts and TLS certificates bound to the gateway—they belong in any compromise rotation plan.

Steps before patching

The CERT-FR alert goes beyond “apply the patch.” First, the agency recommends full network isolation (Internet and internal) to limit lateral movement, snapshots of disk and memory on virtual appliances when possible, and avoiding power-off to preserve evidence. Logs should be sequestered; analysis with indicators of compromise published by Volexity (13 October 2026) is expected. Ivanti also offers its Integrity Check Tool (ICT); CERT-FR notes it requires physical access and may cause service interruption—plan accordingly on high-availability setups.

If the gateway is compromised

When compromise is confirmed or strongly suspected, the official playbook chains reporting to CERT-FR (copying business CSIRTs), factory reset (with the caveat that some threats may persist), then firmware upgrade. Critically, secrets stored on or traversing the appliance should be treated as compromised: reset LDAP/AD secrets (CERT-FR cites lateral movement via these accounts), revoke and reissue certificates (machines, user auth, code signing, management TLS), admin password, API keys, local accounts, and Kerberos tickets for service accounts, plus reset license-server authentication. Lateral-movement hunting from the appliance (IoCs, outbound Internet connections, destination IP correlation) completes the cycle.