Vulnerabilities
Ivanti urges urgent patching after Connect Secure zero-day attacks
Ivanti has warned customers to patch a critical flaw in its Connect Secure VPN, after reports of active attacks exploiting the vulnerability.
Ross Grant3 min read
The short version
Ivanti, a company that makes remote access software for businesses, has found a serious security flaw in its Connect Secure product. Hackers are already using this flaw to break into company systems without needing a password. Ivanti is telling customers to update their software right away. If you use this product, check for updates and follow the company's advice.
By the numbers
- 5,500+Connect Secure instances exposed online (not all may be vulnerable)BleepingComputer
- 40,000+Ivanti customers worldwideBleepingComputer
- 3,000+Ivanti employeesBleepingComputer
- 36Ivanti vulnerabilities flagged by CISA as exploited since 2021BleepingComputer
What happened?
Ivanti has warned customers about a zero-day vulnerability in its Connect Secure remote access gateway. The flaw, tracked as CVE-2026-104935, is being actively exploited by attackers to bypass authentication and run commands on affected devices. Security firms Volexity and Defused have reported attacks since early October 2026. Ivanti has released some patches and is working on further fixes.
What is Ivanti Connect Secure?
Ivanti Connect Secure (ICS) is a remote access gateway used by businesses to let employees, contractors and partners connect securely to company systems from outside the office. It was formerly known as Pulse Connect Secure and is widely used by large organisations around the world.
Details of the new zero-day vulnerability
On 13 October 2026, Ivanti warned customers about a new zero-day vulnerability in Connect Secure, tracked as CVE-2026-104935. A zero-day is a security flaw that is actively exploited before a fix is available. This particular flaw lets attackers bypass authentication and run commands on the device without needing any valid login details. The attacks are described as low-complexity, meaning they do not require special skills or user interaction.
The vulnerability affects ICS versions 22.8R2.4 and earlier, 25.1.2.2 and earlier, and 25.1.1.1 and earlier. Ivanti has released patches for some flaws but is still working on a fix for a related privilege escalation issue that attackers have also used.
How attackers have exploited the flaw
Cybersecurity firm Volexity discovered the vulnerability and reported that a previously unknown group, tracked as UTA0576, has been exploiting it since at least 3 October. The attackers chained this flaw with two others to gain full control (root-level access) on devices, even those that were fully patched for earlier issues. Notably, they did not install malware or web shells. Instead, they re-exploited the device for each command and tampered with logs to hide their activity, making it harder to detect.
Another security company, Defused, confirmed seeing exploitation in the wild from 1 October. Ivanti says it is working directly with affected organisations and has urged all customers to upgrade to the fixed version and use its Integrity Checker Tool regularly.
Previous incidents and wider context
Ivanti products have been targeted by attackers before, often through zero-day vulnerabilities. In the past few years, several major flaws in Connect Secure have been exploited, sometimes in combination, to deploy malware or steal data. For example, in early 2024, Ivanti patched two serious vulnerabilities (CVE-2023-46805 and CVE-2024-21887), and more recently, two remote code execution flaws (CVE-2025-0282 and CVE-2025-22457) were fixed after being used by attackers, including state-linked groups.
The US Cybersecurity and Infrastructure Security Agency (CISA) has flagged 36 vulnerabilities in Ivanti products as actively exploited since 2021, with 12 abused by ransomware gangs.
What should affected organisations do?
Ivanti recommends that anyone running the affected versions should upgrade to the latest fixed version immediately. Regularly running the Integrity Checker Tool can help spot signs of compromise, but as this attack shows, determined attackers may try to evade such checks. Organisations should review their logs, look for unusual activity, and consider wider incident response steps if they suspect compromise. Keeping all software up to date and monitoring for vendor advisories is essential.
What is not yet clear
At the time of writing, only BleepingComputer has reported this story, and there is no official statement from Ivanti or a government agency. The number of affected systems is unknown, as is the full impact of the attacks. Shadowserver tracks over 5,500 ICS instances exposed online, but it is unclear how many are vulnerable or have already been secured.
Practical advice
If you manage Ivanti Connect Secure, check your version, apply any available patches, and follow Ivanti’s latest guidance. Monitor for unusual log entries and consider consulting with security experts if you suspect your systems have been targeted.
Claimed vs confirmed
- Confirmed
Attackers are exploiting a zero-day in Ivanti Connect Secure to bypass authentication and run commands.
Reported by BleepingComputer, citing Volexity and Defused. Ivanti has urged immediate patching.
- Confirmed
Attackers have chained this flaw with others to gain root access and evade detection.
Reported by Volexity, confirmed by Defused.
- Denied
Ivanti has released all necessary patches.
Ivanti is still working on a fix for a related privilege escalation flaw.
The impact
- Money
- Ivanti and affected customers could face costs from incident response, possible data loss, and regulatory fines. Under GDPR, fines can reach €20 million or 4% of global turnover.
- Reputation
- Ivanti has a history of zero-day vulnerabilities being exploited, which may affect customer trust. The visibility of this incident could impact its reputation further if more details emerge.
- Customers
- Organisations using Connect Secure are at risk of unauthorised access. They should patch immediately and check for signs of compromise.
Why it matters
This vulnerability puts thousands of organisations at risk, as attackers can gain full access to company systems without needing any login details. Past incidents show that flaws in Ivanti products have been used to steal data or install malware. Quick action is needed to prevent further breaches.
How does it work?
The vulnerability allows attackers to bypass authentication and execute arbitrary commands on Ivanti Connect Secure appliances. Attackers do not need valid credentials or user interaction. In observed attacks, they chained this flaw with others to gain full control and tampered with logs to hide their activity.
Key points
- Ivanti Connect Secure has a critical zero-day vulnerability being actively exploited.
- Attackers can bypass authentication and run commands without credentials.
- Ivanti urges customers to patch immediately and use the Integrity Checker Tool.
- Previous Ivanti flaws have been widely exploited, sometimes by ransomware gangs.
- The full impact is not yet clear, and only one source has reported the story so far.
Sources
BleepingComputer
Reference
