{
  "id": 14500318,
  "title": "Ivanti patches Connect Secure zero-day after researchers confirm in-the-wild attacks",
  "url": "https://urgent.news/2026/10/14/ivanti-patches-connect-secure-zero-day-after-researchers-confirm-in-14500318",
  "topic": "tech",
  "section": "Tech",
  "published": "2026-10-14T17:15:00.000Z",
  "source": {
    "name": "The Register Science",
    "slug": "the-register-science",
    "url": "https://www.theregister.com/security/2026/10/14/ivanti-patches-connect-secure-zero-day-after-researchers-confirm-in-the-wild-attacks/5303095"
  },
  "original_language": "en",
  "account": "Ivanti has released patches for Connect Secure to address a zero-day vulnerability, CVE-2026-104935, which allows remote, unauthenticated attackers to execute arbitrary commands. The authentication bypass flaw was discovered by Volexity and rated 8.6 on the CVSS scale. Ivanti has identified affected releases in the 25.1.1.1 and earlier, 25.1.2.2 and earlier, and 22.8R2.4 and earlier branches. The vendor urges customers to update Connect Secure and check for compromise, recommending the use of the Ivanti Integrity Checker Tool regularly. Although limited indicators of compromise are available, Volexity notes that attackers appeared to be most interested in credential theft, data exfiltration, log tampering, and network reconnaissance. Notably, the attackers did not deploy malware or execute web shells, using only available commands on the ICS appliance. Volexity suspects large language models played a role in the attackers' activities. Ivanti previously patched a portion of the vulnerability in the July 25.1.3.0 update, but attackers exploited it before the backporting work was complete.",
  "summary": "Vendor promises fix for separate privilege-escalation flaw in the coming weeks",
  "key_points": [],
  "editors_take": null,
  "illustration": null,
  "coverage": {
    "outlets": 2,
    "also_reported_by": [
      {
        "outlet": "The Register",
        "title": "Ivanti patches Connect Secure zero-day after researchers confirm in-the-wild attacks",
        "url": "https://urgent.news/2026/10/14/ivanti-patches-connect-secure-zero-day-after-researchers-confirm-in",
        "published": "2026-10-14T17:15:00.000Z"
      }
    ]
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}