25.1.1[.]1IP address
Reported by 4 independent sources · first reported by Dark Web Informer · last reported
Last reported 9 days ago
What the reports say
4 reports, newest first · the exact sentence from each-
CVE-2026-104935 | Ivanti Connect Secure Authentication Bypass and Remote Code Execution Vulnerability“ICS 25.1.0.0 through 25.1.1[.]1.”
-
Ivanti patches Connect Secure zero-day after researchers confirm in-the-wild attacks“Ivanti lists affected releases in the following branches: 25.1.1[.]1 and earlier 25.1.2.2 and earlier 22.8R2.4 and earlier The vendor said it previously identified "a portion of this vulnerability" and patched it in July's 25.1.3.0 update, and had been working on backporting the sa…”
-
Múltiples vulnerabilidades en productos de Ivanti“25.1.1[.]1 y anteriores;”
-
Ivanti Patches Actively Exploited Connect Secure Zero-Day and Critical Credential-Leak Flaws“• Connect Secure 25.1.1[.]1 and earlier”
Indicators reported together
named in the same reports- 25.1.2[.]2in 4 reports
- 25.1.1[.]2in 2 reports
- 25.1.3[.]1in 2 reports
Copy these 3 indicators · defanged
Also named with it: CVE-2026-104935, CVE-2026-109412, CVE-2026-106042, CVE-2026-106047, CVE-2026-106043, CVE-2026-106034, CVE-2026-106035
Thanks — we review every report.