The US cybersecurity agency CISA is warning about CVE-2026-104935 in Ivanti Connect Secure, a flaw that attackers are already exploiting. The bug bypasses authentication and allows remote command execution without credentials, which attackers use to steal credentials and data. Versions 25.1.1.1, 25.1.2.2 and 22.8R2.4 and earlier are affected, and the flaw was added to the KEV catalogue on 13 October. Because commands run in memory, Ivanti's integrity checker may not reveal a compromise.
What it means: Remote access appliances are the front door for many Greek businesses, from accounting offices to retail chains running a central ERP. When such a gateway allows command execution without login, an attacker is inside the network before anyone sees an alert. The most worrying detail is that activity lives in memory, so a quick check can create a false sense of safety. Anyone running Ivanti Connect Secure should upgrade at once, rotate passwords and certificates that pass through the appliance, and review logs for unusual sessions since early October. For organisations covered by the Greek NIS2 law, an incident like this may trigger an early reporting duty, so the call on whether a breach happened should not drag on. Strategically, version 22.8 reaches end of life in January 2027, which makes this a good moment to ask whether the company still needs a classic VPN or could move to per-application access with stronger identity checks.
Related service: Custom software