Ivanti warns of Connect Secure zero-day exploited in attacks
Ivanti urged customers on Tuesday to immediately patch an actively exploited zero-day vulnerability in the Ivanti Connect Secure (ICS) remote access gateway.
Ivanti urged customers on Tuesday to immediately patch an actively exploited zero-day vulnerability in the Ivanti Connect Secure (ICS) remote access gateway.
Formerly known as Pulse Connect Secure and originally Juniper Pulse, the enterprise-grade ICS SSL VPN provides remote employees, contractors, and hybrid workforces with secure access to corporate and cloud resources.
Tracked as CVE-2026-104935 , this high-severity authentication bypass zero-day affects ICS versions 22.8R2.4 and earlier, 25.1.2.2 and earlier, and 25.1.1.1 and earlier.
"At the time of disclosure, Ivanti is aware of limited exploitation in the wild.
Cybersecurity firm Volexity, which found and reported the flaw, revealed earlier today that a previously unknown threat actor it tracks as UTA0576 has chained the CVE-2026-104935 vulnerability since at least October 3 with two other flaws to achieve unauthenticated root-level code execution on fully patched devices.
Instead, the threat actor re-exploited the device for every command it ran and tampered with logs to cover its tracks, evading Ivanti’s Integrity Checker Tool," Volexity said .
Remote threat actors without privileges can exploit CVE-2026-104935 in low-complexity attacks that don't require user interaction to execute arbitrary commands on targeted ICS appliances.
We are working directly with those organizations while making information, updates and remediation available to the broader customer community.
If you are running one of the impacted versions, Ivanti recommends you act immediately," Ivanti said .
Internet threat watchdog Shadowserver now tracks over 5,500 ICS instances exposed online , but there is no information on how many are honeypots or have already been secured against ongoing attacks.
While Ivanti has patched two flaws, it is still working to address a privilege escalation vulnerability that UTA0576 exploited as part of the same chain.
Threat intelligence company Defused also confirmed Volexity's report , saying that it caught the first signs of CVE-2026-104935 exploitation in the wild starting October 1.
Hackers have frequently exploited Ivanti vulnerabilities, often as zero-days, because they provide a quick way to breach enterprise networks and steal sensitive customer and corporate data.
Ivanti has also patched several other Connect Secure zero-days exploited in the wild over the past several years, some of them chained in widespread attacks to deploy malware .
What happened
Ivanti urged customers on Tuesday to immediately patch an actively exploited zero-day vulnerability in the Ivanti Connect Secure (ICS) remote access gateway.
Formerly known as Pulse Connect Secure and originally Juniper Pulse, the enterprise-grade ICS SSL VPN provides remote employees, contractors, and hybrid workforces with secure access to corporate and cloud resources.
Tracked as CVE-2026-104935 , this high-severity authentication bypass zero-day affects ICS versions 22.8R2.4 and earlier, 25.1.2.2 and earlier, and 25.1.1.1 and earlier.
What changed
"At the time of disclosure, Ivanti is aware of limited exploitation in the wild.
Cybersecurity firm Volexity, which found and reported the flaw, revealed earlier today that a previously unknown threat actor it tracks as UTA0576 has chained the CVE-2026-104935 vulnerability since at least October 3 with two other flaws to achieve unauthenticated root-level code execution on fully patched devices.
Instead, the threat actor re-exploited the device for every command it ran and tampered with logs to cover its tracks, evading Ivanti’s Integrity Checker Tool," Volexity said .
Who is affected
Remote threat actors without privileges can exploit CVE-2026-104935 in low-complexity attacks that don't require user interaction to execute arbitrary commands on targeted ICS appliances.
We are working directly with those organizations while making information, updates and remediation available to the broader customer community.
Why it matters
If you are running one of the impacted versions, Ivanti recommends you act immediately," Ivanti said .
Internet threat watchdog Shadowserver now tracks over 5,500 ICS instances exposed online , but there is no information on how many are honeypots or have already been secured against ongoing attacks.
Technical details
While Ivanti has patched two flaws, it is still working to address a privilege escalation vulnerability that UTA0576 exploited as part of the same chain.
Threat intelligence company Defused also confirmed Volexity's report , saying that it caught the first signs of CVE-2026-104935 exploitation in the wild starting October 1.
Hackers have frequently exploited Ivanti vulnerabilities, often as zero-days, because they provide a quick way to breach enterprise networks and steal sensitive customer and corporate data.
Response
Ivanti has also patched several other Connect Secure zero-days exploited in the wild over the past several years, some of them chained in widespread attacks to deploy malware .
More recently, it fixed a remote code execution (RCE) vulnerability tracked as CVE-2025-0282 in January 2025 and a second RCE flaw (CVE-2025-22457) that China-linked cyber spies have exploited since at least mid-March 2025 .
What security teams should do
Join Mikko Hyppönen and security leaders from the NFL, CHANEL, and Atlassian for a two-hour digital summit on what AI-speed attacks change, what defenders should stop doing, and how to validate, decide, fix, and re-validate at machine speed.
It addressed an authentication bypass (CVE-2023-46805) and a command injection (CVE-2024-21887) in early January 2024 , and a server-side request forgery (CVE-2024-21893) two weeks later .
What remains unknown
Internet threat watchdog Shadowserver now tracks over 5,500 ICS instances exposed online , but there is no information on how many are honeypots or have already been secured against ongoing attacks.
Cybersecurity firm Volexity, which found and reported the flaw, revealed earlier today that a previously unknown threat actor it tracks as UTA0576 has chained the CVE-2026-104935 vulnerability since at least October 3 with two other flaws to achieve unauthenticated root-level code execution on fully patched devices.
Attribution
BleepingComputer: Ivanti urged customers on Tuesday to immediately patch an actively exploited zero-day vulnerability in the Ivanti Connect Secure (ICS) remote access gateway.
What to watch next
Watch for additional victim details, indicators of compromise and follow-on exploitation reports.
Watch for revised vendor guidance, fixed versions and mitigation updates.