Ivanti warns of Connect Secure zero-day exploited in attacks

Ivanti urged customers on Tuesday to immediately patch an actively exploited zero-day vulnerability in the Ivanti Connect Secure (ICS) remote access gateway.

Formerly known as Pulse Connect Secure and originally Juniper Pulse, the enterprise-grade ICS SSL VPN provides remote employees, contractors, and hybrid workforces with secure access to corporate and cloud resources.

Tracked as CVE-2026-104935, this high-severity authentication bypass zero-day affects ICS versions 22.8R2.4 and earlier, 25.1.2.2 and earlier, and 25.1.1.1 and earlier.

Remote threat actors without privileges can exploit CVE-2026-104935 in low-complexity attacks that don't require user interaction to execute arbitrary commands on targeted ICS appliances.

"At the time of disclosure, Ivanti is aware of limited exploitation in the wild. We are working directly with those organizations while making information, updates and remediation available to the broader customer community. If you are running one of the impacted versions, Ivanti recommends you act immediately," Ivanti said.

"Customers should review the security advisory, upgrade to the fixed version as soon as possible, and run the Integrity Checker Tool regularly."

Internet threat watchdog Shadowserver now tracks over 5,500 ICS instances exposed online, but there is no information on how many are honeypots or have already been secured against ongoing attacks.

Exploited since at least October 3

Cybersecurity firm Volexity, which found and reported the flaw, revealed earlier today that a previously unknown threat actor it tracks as UTA0576 has chained the CVE-2026-104935 vulnerability since at least October 3 with two other flaws to achieve unauthenticated root-level code execution on fully patched devices.

"Notably, UTA0576 deployed no malware or web shell. Instead, the threat actor re-exploited the device for every command it ran and tampered with logs to cover its tracks, evading Ivanti’s Integrity Checker Tool," Volexity said.

While Ivanti has patched two flaws, it is still working to address a privilege escalation vulnerability that UTA0576 exploited as part of the same chain.

Threat intelligence company Defused also confirmed Volexity's report, saying that it caught the first signs of CVE-2026-104935 exploitation in the wild starting October 1.

​Hackers have frequently exploited Ivanti vulnerabilities, often as zero-days, because they provide a quick way to breach enterprise networks and steal sensitive customer and corporate data.

Ivanti has also patched several other Connect Secure zero-days exploited in the wild over the past several years, some of them chained in widespread attacks to deploy malware.

It addressed an authentication bypass (CVE-2023-46805) and a command injection (CVE-2024-21887) in early January 2024, and a server-side request forgery (CVE-2024-21893) two weeks later.

More recently, it fixed a remote code execution (RCE) vulnerability tracked as CVE-2025-0282 in January 2025 and a second RCE flaw (CVE-2025-22457) that China-linked cyber spies have exploited since at least mid-March 2025.

The Cybersecurity and Infrastructure Security Agency (CISA) has flagged 36 vulnerabilities across various Ivanti products as actively exploited in the wild since November 2021, 12 of which ransomware gangs have also abused.

Ivanti has over 3,000 employees, a network of over 7,000 partners, and more than 40,000 customers worldwide using its IT asset management solutions.