Ivanti warns of actively exploited Connect Secure zero-day

Ivanti on Tuesday urged customers to immediately install a patch for an actively exploited zero-day in its Ivanti Connect Secure (ICS) remote access gateway. The enterprise-grade SSL VPN — formerly Pulse Connect Secure and originally Juniper Pulse — gives remote employees, contractors, and hybrid workforces secure access to corporate and cloud resources.

Tracked as CVE-2026-104935, the high-severity authentication bypass affects ICS versions 22.8R2.4 and earlier, 25.1.2.2 and earlier, and 25.1.1.1 and earlier. Remote attackers with no privileges can exploit it in low-complexity attacks that require no user interaction to execute arbitrary commands on a vulnerable appliance.

"At the time of disclosure, Ivanti is aware of limited exploitation in the wild. We are working directly with those organizations while making information, updates and remediation available to the broader customer community. If you are running one of the impacted versions, Ivanti recommends you act immediately," the company said. Customers are advised to review the security advisory, upgrade to the fixed version as soon as possible, and run the Integrity Checker Tool regularly.

Exploited since early October

Internet watchdog Shadowserver counts more than 5,500 ICS instances exposed online, though it is unclear how many are honeypots or have already been secured.

Volexity, which found and reported the flaw, said a previously unknown threat actor it tracks as UTA0576 has chained CVE-2026-104935 with two other flaws since at least October 3 to achieve unauthenticated root-level code execution even on fully patched devices. Notably, UTA0576 deployed no malware or web shells; instead, it re-exploited the device for every command it ran and tampered with logs to cover its tracks, evading Ivanti's Integrity Checker Tool.

Ivanti has patched two of the flaws but is still working to fix a privilege escalation vulnerability used in the same chain. Threat intelligence firm Defused corroborated Volexity's findings, noting the first signs of exploitation as early as October 1.

A recurring pattern

Ivanti flaws have long drawn attackers, frequently as zero-days, because they offer a fast route into enterprise networks. In recent years the company has patched several Connect Secure bugs abused in the wild: an authentication bypass (CVE-2023-46805) and a command injection (CVE-2024-21887) in early January 2024, an SSRF (CVE-2024-21893) two weeks later, and two RCE flaws — CVE-2025-0282 in January 2025 and CVE-2025-22457, exploited by China-linked cyber spies since at least mid-March 2025.

Since November 2021, CISA has flagged 36 vulnerabilities across Ivanti products as actively exploited, twelve of them also abused by ransomware gangs. Ivanti's IT asset management solutions are used by more than 40,000 customers worldwide.

Source: Bleeping Computer