Ivanti warns of Connect Secure zero-day exploited in attacks
Ivanti warns of actively exploited zero-day in Connect Secure gateway.
Run Ivanti?
Get an email when a reviewed story names Ivanti, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
Summary
Ivanti has issued an urgent warning about a critical zero-day vulnerability (CVE-2026-104935) in its Connect Secure remote access gateway. This high-severity authentication bypass flaw allows unauthenticated attackers to execute arbitrary commands with low complexity. The company is aware of limited exploitation in the wild and urges customers to patch immediately.
The lesson from this incident
Full lessonA critical authentication bypass vulnerability in Ivanti Connect Secure (CVE-2026-104935) allows unauthenticated attackers to execute arbitrary commands without requiring any credentials, representing one of the most severe risk profiles possible for an internet-facing gateway. The root cause lies in a failure of authentication enforcement logic, meaning the access control boundary that should protect the device can be entirely circumvented. Because Connect Secure is a remote access gateway, exploitation can serve as an entry point to the broader corporate network, amplifying the blast radius significantly. Zero-day vulnerabilities like this underscore the danger of delaying patch cycles, particularly for perimeter-facing devices that are directly reachable from the internet.
What helps against this
How we list vendors
- Zero trust network access (ZTNA)
Remote access no longer means exposing VPN appliances to the internet.
- Vulnerability scanning and prioritisation
You know which systems are vulnerable, and which ones to fix first.
- Automated patch management
Known holes get closed in days, not months.
Indicators of Compromise
- cve — CVE-2026-104935
- cve — CVE-2023-46805
- cve — CVE-2024-21887
- cve — CVE-2024-21893
- cve — CVE-2025-0282
- cve — CVE-2025-22457