Ivanti patches Connect Secure zero-day after researchers confirm in-the-wild attacks
Vendor promises fix for separate privilege-escalation flaw in the coming weeks
Ivanti has released patches for Connect Secure to address a zero-day vulnerability, CVE-2026-104935, which allows remote, unauthenticated attackers to execute arbitrary commands. The authentication bypass flaw was discovered by Volexity and rated 8.6 on the CVSS scale. Ivanti has identified affected releases in the 25.1.1.1 and earlier, 25.1.2.2 and earlier, and 22.8R2.4 and earlier branches.
The vendor urges customers to update Connect Secure and check for compromise, recommending the use of the Ivanti Integrity Checker Tool regularly. Although limited indicators of compromise are available, Volexity notes that attackers appeared to be most interested in credential theft, data exfiltration, log tampering, and network reconnaissance.
Notably, the attackers did not deploy malware or execute web shells, using only available commands on the ICS appliance. Volexity suspects large language models played a role in the attackers' activities. Ivanti previously patched a portion of the vulnerability in the July 25.1.3.0 update, but attackers exploited it before the backporting work was complete.
Written by urgent.news from The Register Science's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
This story
This is one outlet's version. Read the fullest account.
