For informational purposes only.

According to the seller, the exploit works through the standard HTTPS port without credentials or authentication, escalates privileges to `root` and automatically extracts administrator password hashes, LDAP/AD, RADIUS, and SAML keys, and Azure private keys. The seller tested the attack on lab environments and two real targets. On 22.8+ builds with hardened SELinux, data exfiltration may be restricted.

Vulnerability type: Pre-Auth RCE
Affected versions: [25.1.1.1](http://25.1.1.1/), [25.1.2.2](http://25.1.2.2/), 22.8R2.4
Price: $3000

A seller is offering a proof-of-concept for a pre-auth RCE in Ivanti Connect Secure (CVE-2026-104935) affecting versions 25.1.1.1, 25.1.2.2, and 22.8R2.4 for $3000.

Sale of a PoC for a vulnerability in Ivanti Connect Secure (CVE-2026-104935)