Summary
- Ivanti Connect Secure CVE-2026-104935 allows unauthenticated attack under affected conditions.
- Ivanti says exploitation in the wild has occurred; NHS expects more attempts.
- NHS guidance identifies fixed versions and directs users to the vendor advisory.
NHS England has warned organisations about an authentication bypass vulnerability in Ivanti Connect Secure after the vendor acknowledged exploitation in the wild. Its National Cyber Security Operations Centre published alert CC-4866 on 13 October, describing CVE-2026-104935 as a weakness that could allow an unauthenticated remote attacker to execute arbitrary commands on a vulnerable appliance.
The flaw has a CVSS v3 score of 8.6 and is classified in the alert as authentication bypass by spoofing. NHS England lists affected Ivanti Connect Secure software branches and directs operators to the relevant security updates. The national alert itself is labelled medium threat severity, a separate classification from the CVSS score assigned to the technical vulnerability.
Remote-access appliances are sensitive points in enterprise infrastructure because they connect users and administrators to internal services. A successful compromise at that boundary could give attackers a foothold from which to seek information or additional access, depending on local configuration and controls. The NHS notice identifies potential arbitrary command execution but does not assert that every vulnerable appliance has been compromised or that attackers necessarily gain unrestricted access to a complete organisation.
The version guidance requires attention to release branches. NHS England identifies builds before 25.1.1.1, before 25.1.2.2 and before 22.8R2.4 within the respective affected lines. Administrators cannot safely treat a version number from one branch as a substitute for the applicable fixed release in another. Ivanti’s own advisory should be used to match installed versions with appropriate updates and any additional investigation instructions.
The national service reports that Ivanti is aware of exploitation in the wild and says further exploitation is highly likely. That assessment gives the item a different urgency from an ordinary patch bulletin concerning a flaw with no known attacks. It does not identify the current attackers, the number of affected organisations or any confirmed NHS compromise, and those details should not be inferred from the alert’s publication.
Edge and access infrastructure can also complicate incident response. Appliances may sit in front of important applications but be administered separately from ordinary endpoints, and not every organisation has the same monitoring visibility into activity at the perimeter. Reviewing appliance state and authentication records can therefore be as important as changing the running software when exploitation has been reported.
A security advisory describing exploitation in the wild is not equivalent to a confirmed compromise at a particular customer. The vendor may have evidence from observed attempts or investigations, while a national cyber centre may use that report to warn its constituency without publishing victim details. In this case, the NHS alert identifies the vendor’s acknowledgement and adds its own assessment that further exploitation is likely. It does not identify hospitals or other NHS bodies affected.
Remote access devices nevertheless deserve special attention during compromise assessments because authentication and access logs may sit on the appliance rather than in the systems users eventually reach. A patch can prevent a known weakness being exploited again, but may not by itself answer whether an earlier attacker retained access or changed configuration. Any such forensic follow-up should use the vendor’s detailed guidance and the organisation’s own evidence, rather than assuming a specific adversary technique. Because the advisory lists multiple fixed branches, generic automated rules that merely compare part of a version string could also produce incorrect results. The exact installed release and hardware or virtual appliance configuration are therefore relevant to determining exposure.
NHS England encourages affected organisations to review Ivanti’s advisory and apply the relevant update as soon as possible. The notice is a warning to operators, not a report of a new healthcare-service outage. The next meaningful developments will be any vendor updates to exposure or exploitation information and the success of remediation across affected installations.
