Ivanti Connect Secure Zero-Day Exploited in the Wild
A critical authentication bypass vulnerability in Ivanti Connect Secure (CVE-2026-104935) allows unauthenticated attackers to execute arbitrary commands without requiring any credentials, representing one of the most severe risk profiles possible for an internet-facing gateway. The root cause lies in a failure of authentication enforcement logic, meaning the access control boundary that should protect the device can be entirely circumvented. Because Connect Secure is a remote access gateway, exploitation can serve as an entry point to the broader corporate network, amplifying the blast radius significantly. Zero-day vulnerabilities like this underscore the danger of delaying patch cycles, particularly for perimeter-facing devices that are directly reachable from the internet.
Tactical Insight
Immediate actions
- Apply Ivanti's emergency patch or mitigation guidance for CVE-2026-104935 to all affected Connect Secure instances without delay.
- Restrict internet-facing access to the Ivanti admin interface using IP allowlists or jump hosts while patching is underway.
- Audit authentication and command-execution logs on all Connect Secure appliances for signs of exploitation or anomalous activity.
Long-term improvements
- Maintain a continuously updated inventory of all internet-facing network appliances, including firmware and software versions, to enable rapid patch prioritization.
- Establish a formal emergency patching procedure with defined SLAs (e.g., 24–48 hours) for critical, actively exploited vulnerabilities on perimeter devices.
- Implement network segmentation to ensure remote access gateways cannot directly reach sensitive internal segments without additional authentication controls.
Detection measures
- Deploy network-based anomaly detection and SIEM alerting specifically tuned to unusual command execution or unauthenticated session activity on VPN gateways.
- Subscribe to vendor security advisories and threat intelligence feeds (e.g., CISA KEV catalog) to receive real-time notification of active exploitation.
- Conduct regular vulnerability scans targeting internet-exposed assets and validate patch compliance through authenticated scanning.