A critical zero-day vulnerability in Ivanti Connect Secure VPN appliances is under active exploitation. The flaw lets remote attackers bypass authentication and execute arbitrary commands on affected devices without any credentials.
The vulnerability, tracked as CVE-2026-104935, carries a CVSS severity score of 8.6 out of 10. It stems from an authentication bypass through spoofing, which means attackers can trick the system into granting access. Security firm Volexity first detected exploitation activity in early October 2026.
Ivanti confirmed the attacks on October 13 and said the flaw had affected “a limited number of customers” before disclosure. The company also revealed that its own product security team had partially discovered the issue earlier. As a result, a partial fix shipped in the July 2026 release (version 25.1.3.0). However, attackers began exploiting the flaw while Ivanti was still backporting the fix to older supported versions.
Affected versions include ICS 25.1.1.1 and earlier, 25.1.2.2 and earlier, and 22.8R2.4 and earlier. Versions 22.7.x and below remain unaffected. Ivanti has now released patched versions 25.1.1.2, 25.1.3.1, and 22.8R2.5 to address the issue.
Volexity also found that attackers chained this flaw with a separate privilege escalation vulnerability that remains unpatched. Ivanti plans to release a fix for that second flaw later. Meanwhile, reliable indicators of compromise are not yet available from Ivanti itself. Volexity has published its own indicators on GitHub for organizations to use in threat hunting.
Federal agencies in the United States now face an October 16 deadline to apply the patches. Security researchers recommend that all organizations treat this as an emergency update, even outside regular patch cycles. Administrators should also hunt for signs of compromise, since attackers may have already gained access before the patch became available.
This marks yet another zero-day targeting Ivanti’s VPN products, which have faced repeated exploitation over the past two years.