25.1.2[.]2IP address
Reported by 8 independent sources · first reported by CISA advisories · last reported
Last reported 9 days ago
What the reports say
8 reports, newest first · the exact sentence from each-
CVE-2026-104935 | Ivanti Connect Secure Authentication Bypass and Remote Code Execution Vulnerability“ICS 25.1.2.0 through 25.1.2[.]2.”
-
Ivanti patches Connect Secure zero-day after researchers confirm in-the-wild attacks“Ivanti lists affected releases in the following branches: 25.1.1.1 and earlier 25.1.2[.]2 and earlier 22.8R2.4 and earlier The vendor said it previously identified "a portion of this vulnerability" and patched it in July's 25.1.3.0 update, and had been working on backporting the sa…”
-
CISA Urges Immediate Ivanti Connect Secure Updates as Honeypots Log 105 Exploit Attempts“…urity flaw, tracked as CVE-2026-104935 (CVSS score: 8.6), is a case of authentication bypass impacting ICS versions 25.1.1.1 and prior, 25.1.2[.]2 and prior, and 22.8R2.4 and prior that could allow a remote unauthenticated attacker to execute arbitrary commands.”
-
Ivanti Connect Secure Zero-Day CVE-2026-104935 Exploited in Chained Attacks“25.1.2[.]2 and prior”
-
Múltiples vulnerabilidades en productos de Ivanti“25.1.2[.]2 y anteriores;”
-
Ivanti Connect Secure zero-day exploited in the wild (CVE-2026-104935)“25.1.2[.]2 and prior in the applicable code line”
-
Ivanti Patches Actively Exploited Connect Secure Zero-Day and Critical Credential-Leak Flaws“• Connect Secure 25.1.2[.]2 and earlier”
-
CISA Urges Patching Newly Exploited Vulnerability in Ivanti Connect Secure“…f Ivanti’s disclosure of a newly exploited vulnerability, CVE-2026-104935, affecting Ivanti Connect Secure versions 25.1.1.1 and prior, 25.1.2[.]2 and prior, and 22.8R2.4 and prior.”
Indicators reported together
named in the same reports- 25.1.1[.]1in 4 reports
- 25.1.1[.]2in 4 reports
- 25.1.3[.]1in 4 reports
- log[.]eventsin 1 report
- 108.165.147[.]64in 1 report
- 216.73.160[.]59in 1 report
- 216.73.160[.]61in 1 report
- 216.73.160[.]210in 1 report
- 45.8.19[.]111in 1 report
Copy these 9 indicators · defanged
Also named with it: CVE-2026-104935, CVE-2026-109412, CVE-2026-106042, CVE-2026-106047, CVE-2026-106043, CVE-2026-106034, CVE-2026-106035
Thanks — we review every report.