Ivanti warns of Connect Secure zero-day exploited in attacks

Ivanti has released an urgent patch for a high-severity authentication bypass flaw in its Connect Secure (ICS) remote access gateway, warning that attackers are already exploiting it. The vulnerability, cataloged as CVE-2026-104935 and discovered by Volexity, affects ICS versions 22.8R2.4 and earlier, 25.1.2.2 and earlier, and 25.1.1.1 and earlier. It allows unauthenticated remote attackers to run arbitrary commands on vulnerable appliances without any user interaction, making it an easy entry point into corporate networks. Ivanti confirmed limited real-world exploitation and is advising customers to upgrade immediately and routinely run its Integrity Checker Tool, while Shadowserver reports more than 5,500 ICS instances still reachable from the internet. This marks yet another in a long string of Connect Secure zero-days abused by attackers in recent years, following flaws like CVE-2023-46805, CVE-2024-21887, CVE-2024-21893, CVE-2025-0282 and CVE-2025-22457.