Ivanti Connect Secure: mapping African exposure
CVE-2026-8941 in Ivanti Connect Secure directly affects remote-access VPNs deployed across major African telecoms. An overview of exposed operators.
Severity
3Affected country
ZASector
TelecomsPublished
19 May 2026
Our score measures operational relevance to Africa — not the global virality of the story.
Contents · 5
The vulnerability
CVE-2026-8941 is a remote code execution (RCE) vulnerability in Ivanti Connect Secure's certificate management component. It affects all versions prior to 22.7R2.5.
African footprint
According to Shodan data and RIPE NCC records, exposed Ivanti Connect Secure instances on the African continent are concentrated in five countries: South Africa, Nigeria, Kenya, Morocco, Egypt.
MTN Group, Safaricom, Maroc Telecom and Telecom Egypt are among the operators for which potentially vulnerable instances were identified on their official IP ranges.
Sovereignty stakes
These VPNs form the backbone of remote access in these organisations — they protect internal networks, billing systems and network management interfaces.
Immediate recommendations
- Apply the Ivanti 22.7R2.5 patch immediately.
- Enable authentication logs and search for CISA-published indicators of compromise.
- Restrict management interface access to trusted IPs only.
Conclusion
The time gap between vulnerability disclosure and targeted exploitation narrows every year. African operators must integrate patch management cycles into their service-level agreements.
— ◆ —