Ivanti Connect Secure Zero-Day CVE-2026-104935 Exploited in the Wild—Patch Immediately
Ivanti is urging customers to immediately patch a high-severity zero-day vulnerability that is being actively exploited in Ivanti Connect Secure (ICS) remote access gateways.
Ivanti Connect Secure is an enterprise SSL VPN, formerly known as Pulse Connect Secure and originally Juniper Pulse. The platform provides secure access to corporate and cloud resources for remote employees, contractors, and hybrid workforces.
Ivanti Connect Secure CVE-2026-104935 vulnerability
Tracked as CVE-2026-104935, the flaw is an authentication bypass vulnerability affecting ICS versions 22.8R2.4 and earlier, 25.1.2.2 and earlier, and 25.1.1.1 and earlier.
An unprivileged, remote attacker can exploit CVE-2026-104935 with a low-complexity attack that requires no user interaction to execute arbitrary commands on a targeted ICS appliance.
“At the time of disclosure, Ivanti is aware of limited exploitation in the wild. We are working directly with these organizations to provide information, updates, and remediation to the broader customer community. If you are running any of the affected versions, Ivanti encourages you to act immediately,” Ivanti said.
“Customers should review security advisories, upgrade to fixed versions as soon as possible, and run the Integrity Checker tool regularly.”
Attackers chained the zero-day to gain root access
Cybersecurity company Volexity discovered and reported the vulnerability. The company revealed earlier today that an unknown attacker tracked as UTA0576 had been chaining CVE-2026-104935 with two other flaws to achieve unauthenticated, root-level code execution on fully patched devices since at least October 3.
“Notably, UTA0576 did not introduce malware or a web shell. Instead, the threat actor re-exploited the device with every command it executed, tampered with logs to cover its tracks, and evaded Ivanti’s integrity checker tools,” Volexity said.
More than 5,500 ICS instances exposed online
Internet threat watchdog Shadowserver currently tracks more than 5,500 ICS instances exposed online. However, there is no information about how many of these are honeypots or whether the devices are already secured against the ongoing attacks.
Ivanti Connect Secure has a history of zero-day attacks
Hackers have repeatedly exploited Ivanti vulnerabilities as zero-day attacks, using the flaws to penetrate corporate networks and steal sensitive customer and corporate data.
Ivanti has also patched several other Connect Secure zero-days exploited over the past few years. Some of those attacks escalated into widespread incidents involving malware deployment.
In early January 2024, attackers exploited the authentication bypass vulnerability CVE-2023-46805 and command injection vulnerability CVE-2024-21887. Two weeks later, attackers exploited the server-side request forgery vulnerability CVE-2024-21893.
Most recently, Ivanti fixed the remote code execution vulnerability CVE-2025-0282, disclosed in January 2025, as well as a second RCE flaw, CVE-2025-22457. China-linked cyber spies had exploited CVE-2025-22457 since at least mid-March 2025.
CISA warns about exploited Ivanti vulnerabilities
The Cybersecurity and Infrastructure Security Agency (CISA) has issued a warning concerning 36 vulnerabilities across various Ivanti products. The vulnerabilities have been actively exploited since November 2021, with 12 ransomware gangs also exploiting them.
Ivanti has more than 3,000 employees and a network of more than 7,000 partners. Its IT asset management solutions serve more than 40,000 customers worldwide.
Join Mikko Hypponen and security leaders from the NFL, Chanel, and Atlassian for a two-hour digital summit about what will change with AI-speed attacks, what defenders should stop doing, and how to verify, decide, fix, and revalidate at machine speed.
Source: www.bleepingcomputer.com