Ivanti Connect Secure zero-day: patch now, exploited in the wild

Ivanti has warned customers to immediately patch an actively exploited zero-day in Ivanti Connect Secure (ICS), the enterprise SSL VPN formerly known as Pulse Connect Secure, according to BleepingComputer. The flaw, listed as CVE-2026-104935, is a high-severity authentication bypass that affects multiple ICS versions and has been observed in the wild.

What happened

According to BleepingComputer, CVE-2026-104935 affects ICS versions 22.8R2.4 and earlier, 25.1.2.2 and earlier, and 25.1.1.1 and earlier. Ivanti urged customers to upgrade to fixed versions and to run its Integrity Checker Tool regularly. Internet-exposed ICS instances are common: Shadowserver now tracks over 5,500 public ICS instances, the outlet reports.

Cybersecurity firm Volexity, which found and reported the flaw, told BleepingComputer that a previously unknown actor it calls UTA0576 has chained CVE-2026-104935 with two other flaws since at least October 3 to achieve unauthenticated root-level code execution on fully patched devices. Defused, another threat intelligence company, confirmed early signs of exploitation beginning October 1, according to the same report.

How attackers are using the flaw

BleepingComputer reports that Volexity observed the attacker chaining this authentication bypass with additional vulnerabilities to reach root-level execution. Volexity noted the actor did not deploy malware or a web shell; instead, it re-exploited the device for each command and altered logs to hide activity. Ivanti has already patched two of the flaws involved, but it is still addressing a privilege escalation issue used in the chain, the outlet says.

Ivanti products have been frequent targets in prior years: BleepingComputer notes Ivanti fixed several other Connect Secure zero-days in recent years, and that the U.S. Cybersecurity and Infrastructure Security Agency (CISA) has flagged dozens of Ivanti vulnerabilities as exploited in the wild since November 2021.

Who is at risk

Enterprise and public sector customers that use Ivanti Connect Secure as their remote access gateway are the primary risk group, since the product provides SSL VPN access for employees, contractors, and hybrid workforces. The affected versions listed by BleepingComputer define the immediate patching scope. Shadowserver's count of over 5,500 exposed ICS instances gives a sense of how many gateways are reachable from the internet, though that number may include honeypots and already-secured systems.

BleepingComputer also reports Ivanti’s market footprint: the company has over 3,000 employees, more than 7,000 partners, and over 40,000 customers for its IT asset management solutions, underlining why a widely used VPN flaw draws active exploitation.

Immediate steps you should take

• Verify whether you run an affected Ivanti Connect Secure version and, if so, upgrade to the fixed version Ivanti publishes, as BleepingComputer reports.
• If you cannot upgrade immediately, isolate exposed ICS appliances from the internet where possible and restrict management interfaces to trusted networks.
• Run Ivanti’s Integrity Checker Tool and review its results, understanding that researchers observed attackers tampering with logs; use additional log collection and out-of-band forensic methods where possible.
• Rotate credentials and keys tied to the appliance, and review authentication and privileged accounts for signs of misuse.
• Hunt for indicators of compromise: look for unexpected commands, configuration changes, or re-exploitation patterns. Consider taking affected devices offline for forensic analysis if you suspect compromise.
• Notify partners and affected teams, and follow any incident-handling guidance from your security team or vendor.

If you want a quick external check of whether your site is exposed, start with a free external scan at our security page: /security.html.

What to watch next

Ivanti is continuing to work on fixes for a remaining privilege escalation used in the same attack chain, BleepingComputer reports. Watch for updated advisories from Ivanti and for CISA or other national authorities to issue additional guidance. Given prior patterns of attackers exploiting Ivanti products, assume that publicly reachable VPN appliances present a higher risk and prioritize response accordingly.

This report is based on the reporting by BleepingComputer and the statements from the security firms named in that report. Follow vendor advisories and your internal incident response process for the safest results.