Ivanti Connect Secure Zero‑Day Exploited in the Wild (CVE‑2026‑104935)

What happened

On 13 Oct 2026, Ivanti disclosed CVE‑2026‑104935, a high‑severity authentication bypass in Connect Secure (ICS) that allows unauthenticated remote attackers to run arbitrary commands. The flaw, a spoofing vulnerability (CWE‑290), was already being exploited in the wild before the advisory was issued.

Impact

Exploit activity was confirmed by CISA and documented by the forensics firm Volexity. Affected customers run any supported version of Ivanti Connect Secure that had not yet received the July 2026 patch (25.1.3.0). The vulnerability can be leveraged to gain full system control, and threat actors also used an unpatched privilege‑escalation flaw to widen their foothold.

What defenders should do

• Verify whether your environment runs a vulnerable version of Connect Secure. If so, apply the July 2026 patch or later immediately.
• Block inbound traffic to the VPN appliance on the default port (TCP 443) unless it is required for business use, and enforce strict authentication.
• Deploy network segmentation and monitoring to detect anomalous command execution or lateral movement from the VPN.
• Review logs for signs of spoofed authentication attempts or unexpected remote command execution.
• Consider disabling legacy authentication methods that may be exploited by the bypass.

Future mitigations

Ivanti plans to address a related privilege‑escalation issue in a subsequent release. Until then, maintain the latest patch level and keep the VPN appliance isolated from critical assets.