Ivanti warns attackers exploit Connect Secure zero-day CVE-2026-104935

Ivanti urged customers on 13 October 2026 to immediately patch an actively exploited zero-day vulnerability in the Ivanti Connect Secure remote access gateway, tracked as CVE-2026-104935. The high-severity authentication bypass affects Connect Secure versions 22.8R2.4 and earlier, 25.1.2.2 and earlier, and 25.1.1.1 and earlier, and lets remote attackers without privileges run arbitrary commands on affected appliances.thehackernews.com

The flaw matters because Connect Secure, formerly Pulse Connect Secure and originally Juniper Pulse, gives remote employees, contractors and hybrid workforces access to corporate and cloud resources. A bypass that needs no prior login and no user interaction puts a widely deployed gateway directly in reach of outside attackers. Ivanti said it is aware of limited exploitation in the wild and is working directly with affected organisations.bleepingcomputer.com

What the flaw allows

Volexity, the cybersecurity firm that found and reported the flaw, said threat actor UTA0576 chained CVE-2026-104935 with two other vulnerabilities since at least 3 October 2026 to achieve unauthenticated root-level code execution on fully patched devices. Root access means the attacker can run any command with the highest privileges on the appliance, bypassing normal user restrictions entirely.

The attack chain works because the authentication bypass removes the login requirement, and two further flaws escalate that foothold to root. Volexity said UTA0576 deployed no malware or web shell; instead the attacker re-exploited the device for every command and tampered with logs to cover its tracks, evading Ivanti's Integrity Checker Tool, the diagnostic utility customers use to spot compromise.

Ivanti has patched two of the three chained flaws but is still working to address a privilege escalation vulnerability that UTA0576 exploited as part of the same chain. Threat intelligence company Defused confirmed Volexity's report and said it caught the first signs of CVE-2026-104935 exploitation in the wild starting 1 October 2026, two days before Volexity's earliest observed date.

Which versions are fixed

Ivanti products are frequently targeted: CISA has flagged 36 vulnerabilities across various Ivanti products as actively exploited since November 2021, 12 of which ransomware gangs also abused. Ivanti previously patched an authentication bypass and a command injection in early January 2024, a server-side request forgery two weeks later, and remote code execution flaws CVE-2025-0282 and CVE-2025-22457 in January 2025 and after mid-March 2025.

The remaining privilege escalation vulnerability in the chain is still unpatched, leaving customers who applied the available updates partially protected against the full attack path Volexity documented. Administrators are advised to upgrade to a fixed version and run the Integrity Checker Tool regularly, though Volexity showed UTA0576 tampered with logs to evade that tool.

Ivanti's next step is to release a fix for the outstanding privilege escalation flaw; no release date for that patch appears in the advisory or the reporting. Customers should review the security advisory, upgrade to a fixed version as soon as possible, and run the Integrity Checker Tool regularly, according to Ivanti's own guidance.