GoKawiilIvanti patches Connect Secure zero-day already under attack
Ivanti has issued an urgent patch advisory for CVE-2026-104935, a high-severity authentication bypass flaw in its Connect Secure VPN gateway that is being actively exploited. The vulnerability, discovered by Volexity, affects multiple recent ICS versions and lets unauthenticated attackers run arbitrary commands without user interaction. Shadowserver reports more than 5,500 ICS instances currently exposed online.
GoKawiil's interpretation of the reporting above, not reported fact.
Ivanti's VPN appliances have repeatedly been targeted by hackers seeking a fast route into corporate networks, since compromising a gateway can expose an entire organization's internal systems. The scale of internet-exposed instances suggests many organizations may remain vulnerable until they apply the patch and run Ivanti's Integrity Checker Tool, giving attackers a window to exploit unpatched systems.
- CVE-2026-104935 is a high-severity, unauthenticated authentication bypass in Ivanti Connect Secure.
- Ivanti confirms limited in-the-wild exploitation and urges immediate patching and integrity checks.
- Over 5,500 ICS instances remain exposed online, continuing a pattern of repeated Ivanti zero-day attacks.
Source: bleepingcomputer.com, 2026-10-13
Published there as: “Ivanti warns of Connect Secure zero-day exploited in attacks”
Read the original report → The summary and analysis above are GoKawiil's own, written from reporting by the source above. Facts and quotes belong to the original publisher.