Ivanti Urges Immediate Patching of Connect Secure Zero-Day Exploited in Attacks
Summary
Ivanti says attackers are exploiting an authentication-bypass zero-day in Connect Secure appliances. The flaw affects specified versions and can let unauthenticated remote attackers execute commands; customers should upgrade and run the Integrity Checker Tool.
Key points
- CVE-2026-104935 is a high-severity authentication bypass affecting Ivanti Connect Secure versions 22.8R2.4 and earlier, 25.1.2.2 and earlier, and 25.1.1.1 and earlier.
- Unauthenticated remote attackers can exploit the flaw in low-complexity attacks without user interaction to execute arbitrary commands on appliances.
- Ivanti reports limited exploitation in the wild and is working with affected organizations.
- Ivanti recommends upgrading to a fixed version immediately and regularly running its Integrity Checker Tool.
- Shadowserver tracks more than 5,500 Connect Secure instances exposed online; the number already secured or operating as honeypots is unknown.
Article Details
- Vulnerability Types
- Authentication bypass
- Arbitrary command execution
- Severity
- High
- Affected Versions
- Ivanti Connect Secure 22.8R2.4 and earlier
- Ivanti Connect Secure 25.1.2.2 and earlier
- Ivanti Connect Secure 25.1.1.1 and earlier
- Exploitation Status
- active
- Exploit Availability
- unknown
- Patch Status
- available
CVE
CVE-2023-46805It addressed an authentication bypass (CVE-2023-46805) and a command injection (CVE-2024-21887) in early January 2024, and a server-side request forgery (CVE-2024-21893) two weeks later.CVE-2024-21887It addressed an authentication bypass (CVE-2023-46805) and a command injection (CVE-2024-21887) in early January 2024, and a server-side request forgery (CVE-2024-21893) two weeks later.CVE-2024-21893It addressed an authentication bypass (CVE-2023-46805) and a command injection (CVE-2024-21887) in early January 2024, and a server-side request forgery (CVE-2024-21893) two weeks later.CVE-2025-0282More recently, it fixed a remote code execution (RCE) vulnerability tracked as CVE-2025-0282 in January 2025 and a second RCE flaw (CVE-2025-22457) that China-linked cyber spies have exploited since at least mid-MarchCVE-2025-22457code execution (RCE) vulnerability tracked as CVE-2025-0282 in January 2025 and a second RCE flaw (CVE-2025-22457) that China-linked cyber spies have exploited since at least mid-March 2025.CVE-2026-104935Tracked as CVE-2026-104935, this high-severity authentication bypass zero-day was reported by cybersecurity firm Volexity and affects ICS versions 22.8R2.4 and earlier, 25.1.2.2 and earlier, and 25.1.1.1 and earlier.
People
Vendors
Products
Ivanti Connect SecureIvanti urged customers on Tuesday to immediately patch an actively exploited zero-day vulnerability in the Ivanti Connect Secure (ICS) remote access gateway.Juniper PulseFormerly known as Pulse Connect Secure and originally Juniper Pulse, the enterprise-grade ICS SSL VPN provides remote employees, contractors, and hybrid workforces with secure access to corporate and cloud resources.Pulse Connect SecureFormerly known as Pulse Connect Secure and originally Juniper Pulse, the enterprise-grade ICS SSL VPN provides remote employees, contractors, and hybrid workforces with secure access to corporate and cloud resources.