Ivanti urged customers on Tuesday to immediately patch an actively exploited zero-day vulnerability in the Ivanti Connect Secure (ICS) remote access gateway.
Formerly known as Pulse Connect Secure and originally Juniper Pulse, the enterprise-grade ICS SSL VPN provides remote employees, contractors, and hybrid workforces with secure access to corporate and cloud resources.
Tracked as CVE-2026-104935, this high-severity authentication bypass zero-day affects ICS versions 22.8R2.4 and earlier, 25.1.2.2 and earlier, and 25.1.1.1 and earlier.
Remote threat actors without privileges can exploit CVE-2026-104935 in low-complexity attacks that don’t require user interaction to execute arbitrary commands on targeted ICS appliances.
“At the time of disclosure, Ivanti is aware of limited exploitation in the wild. We are working directly with those organizations while making information, updates and remediation available to the broader customer community. If you are running one of the impacted versions, Ivanti recommends you act immediately,” Ivanti said.
“Customers should review the security advisory, upgrade to the fixed version as soon as possible, and run the Integrity Checker Tool regularly.”
Internet threat watchdog Shadowserver now tracks over 5,500 ICS instances exposed online, but there is no information on how many are honeypots or have already been secured against ongoing attacks.
Cybersecurity firm Volexity, which found and reported the flaw, revealed earlier today that a previously unknown threat actor it tracks as UTA0576 has chained the CVE-2026-104935 vulnerability since at least October 3 with two other flaws to achieve unauthenticated root-level code execution on fully patched devices.
“Notably, UTA0576 deployed no malware or web shell. Instead, the threat actor re-exploited the device for every command it ran and tampered with logs to cover its tracks, evading Ivanti’s Integrity Checker Tool,” Volexity said.
While Ivanti has patched two flaws, it is still working to address a privilege escalation vulnerability that UTA0576 exploited as part of the same chain.
Threat intelligence company Defused also confirmed Volexity’s report, saying that it caught the first signs of CVE-2026-104935 exploitation in the wild starting October 1.
Hackers have frequently exploited Ivanti vulnerabilities, often as zero-days, because they provide a quick way to breach enterprise networks and steal sensitive customer and corporate data.
Ivanti has also patched several other Connect Secure zero-days exploited in the wild over the past several years, some of them chained in widespread attacks to deploy malware.
It addressed an authentication bypass (CVE-2023-46805) and a command injection (CVE-2024-21887) in early January 2024, and a server-side request forgery (CVE-2024-21893) two weeks later.
More recently, it fixed a remote code execution (RCE) vulnerability tracked as CVE-2025-0282 in January 2025 and a second RCE flaw (CVE-2025-22457) that China-linked cyber spies have exploited since at least mid-March 2025.
The Cybersecurity and Infrastructure Security Agency (CISA) has flagged 36 vulnerabilities across various Ivanti products as actively exploited in the wild since November 2021, 12 of which ransomware gangs have also abused.
Ivanti has over 3,000 employees, a network of over 7,000 partners, and more than 40,000 customers worldwide using its IT asset management solutions.
Join Mikko Hyppönen and security leaders from the NFL, CHANEL, and Atlassian for a two-hour digital summit on what AI-speed attacks change, what defenders should stop doing, and how to validate, decide, fix, and re-validate at machine speed.
Cisco warns of new SD-WAN zero-day exploited in attacks
Cisco warns of max severity ISE zero-day exploited in attacks
New Microsoft Defender ‘ShieldCrash’ zero-day grants SYSTEM access
N-able patches max severity N-central flaw amid ongoing attacks
Critical Citrix NetScaler auth bypass now leveraged in attacks
Ledger confirms spy chip implant behind wallet crypto thefts
Nippon Columbia malware incident exposes 8.6 million karaoke fan records
Cyberattack shuts down refrigerators at French supermarkets
Overdue a password health-check? Audit your Active Directory for free
AI is a data-breach time bomb: Read the new report
New OAuth risk analyst agent: Turn 45 minutes of manual review into 15 seconds.
AWS saw a valid key and let the agent clear a production bucket. See how Token Security ties each agent to its owner and limits it to read-only access.
Move from visibility to action with AITEM, Criminal IP’s next evolution of ASM
Is your backup really out of reach? See what the latest attacks reveal.
Terms of Use – Privacy Policy – Ethics Statement – Affiliate Disclosure
Read our posting guidelinese to learn what content is prohibited.
