Ivanti Reports Limited Exploitation of Connect Secure Zero-Day

Ivanti says attackers are exploiting a high-severity zero-day vulnerability in its Connect Secure (ICS) remote access gateway. The company urged customers using affected versions to upgrade immediately.

Tracked as CVE-2026-104935, the authentication bypass affects ICS versions 22.8R2.4 and earlier, 25.1.2.2 and earlier, and 25.1.1.1 and earlier. Ivanti says remote attackers without privileges can exploit it in low-complexity attacks that require no user interaction to run arbitrary commands on targeted appliances.

Cybersecurity firm Volexity reported the flaw. Ivanti said it was aware of limited exploitation in the wild at the time of disclosure and was working with affected organizations. The company advised customers to review its security advisory, upgrade to a fixed version as soon as possible, and run the Integrity Checker Tool regularly.

Shadowserver tracks more than 5,500 ICS instances exposed online. It is not known how many are honeypots or have already been secured against the attacks.

Ivanti Connect Secure has been targeted by attackers through other vulnerabilities in recent years. The U.S. Cybersecurity and Infrastructure Security Agency has flagged 36 vulnerabilities across Ivanti products as actively exploited since November 2021; ransomware gangs have also abused 12 of them.