25.1.1[.]2IP address
Reported by 6 independent sources · first reported by Rapid7 · last reported
Last reported 9 days ago
What the reports say
7 reports, newest first · the exact sentence from each-
CVE-2026-104935 | Ivanti Connect Secure Authentication Bypass and Remote Code Execution Vulnerability“Ivanti recommends moving ICS 22.8 deployments to 25.1.1[.]2 or later; the 22.8 branch reaches end of life on January 31, 2027.”
-
Ivanti Connect Secure Zero-Day CVE-2026-104935 Exploited in Chained Attacks“25.1.1[.]2”
-
Múltiples vulnerabilidades en productos de Ivanti“Ivanti Connect Secure 25.1.1.1 y anteriores: actualizar a la versión 25.1.1[.]2;”
-
Vulnérabilité dans Ivanti Connect Secure (ICS) (14 octobre 2026)“Connect Secure (ICS) version 25.1.1.x antérieures 25.1.1[.]2”
-
Multiples vulnérabilités dans les produits Ivanti (14 octobre 2026)“Connect Secure (ICS) version 25.1.1.x antérieures 25.1.1[.]2”
-
Ivanti Zero-Day Chain Gave Attackers Root Access to Fully Patched VPN“Ivanti has patched these vulnerabilities with the release of ICS versions 22.8R2.5, 25.1.1[.]2, 25.1.3.0, and 25.1.3.1.”
-
Ivanti Connect Secure zero-day exploited in the wild (CVE-2026-104935)“25.1.1[.]2”
Indicators reported together
named in the same reports- 25.1.3[.]1in 7 reports
- 25.1.2[.]2in 4 reports
- 25.1.1[.]1in 2 reports
- log[.]eventsin 1 report
- 108.165.147[.]64in 1 report
- hxxps://www.ivanti[.]com/blog/october-2026-security-updatein 1 report
- hxxps://forums.ivanti[.]com/s/article/Security-Advisory-Ivanti-Connect-Secure-CVE-2026-104935in 1 report
- hxxps://forums.ivanti[.]com/s/article/Security-Advisory-Ivanti-Neurons-Patch-for-Intune-October-2026in 1 report
- hxxps://forums.ivanti[.]com/s/article/Security-Advisory-Ivanti-Xtraction-Multiple-CVEsin 1 report
- hxxps://hub.ivanti[.]com/s/article/Security-Advisory-Ivanti-Connect-Secure-CVE-2026-104935?language=en_USin 1 report
- hxxps://hub.ivanti[.]com/s/article/KB44859?language=en_USin 1 report
- hxxps://hub.ivanti[.]com/s/article/KB44755?language=en_USin 1 report
- hxxps://forums.ivanti[.]com/s/article/KB22964?language=en_USin 1 report
Copy these 13 indicators · defanged
Also named with it: CVE-2026-104935, CVE-2026-109412, CVE-2026-106042, CVE-2026-106047, CVE-2026-106043, CVE-2026-106034, CVE-2026-106035
Thanks — we review every report.