Serial number: AV26-1035
Date: October 13, 2026
Updated: October 30, 2026
As of October 13, 2026, Ivanti is affected by vulnerabilities in the following products:
- Ivanti Connect Secure
- Versions prior to 25.1.1.3
- Versions prior to 25.1.3.1
- Versions prior to 22.8R2.6
- Ivanti Neurons Patch for Intune
- Versions prior to September 16, 2026
- Ivanti Xtraction
- Versions prior to 2026.4
On October 13, 2026, Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2026-104935 to their Known Exploited Vulnerabilities (KEV) Database.
Update 1
Open-source reporting indicates that CVE-2026-111357 is being exploited in the wild.
Update 2
On October 30, 2026, Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2026-111357 and CVE-2026-118527 to their Known Exploited Vulnerabilities (KEV) Catalog.
The Cyber Centre encourages users and administrators to review the provided web links and apply any necessary updates as they become available.