Ivanti Patches Actively Exploited Connect Secure Zero-Day and Critical Credential Flaws
Summary
Ivanti patched an actively exploited Connect Secure authentication bypass and six vulnerabilities in Neurons Patch for Intune and Xtraction. The flaws expose credentials or enable other unauthorized actions; fixes and credential-rotation guidance are available.
Key points
- CVE-2026-104935 affects Ivanti Connect Secure gateways and lets unauthenticated remote attackers bypass authentication and execute commands. Ivanti confirmed limited exploitation.
- Affected Connect Secure versions include 22.8R2.4 and earlier, 25.1.2.2 and earlier, and 25.1.1.1 and earlier. Administrators should install fixed releases and run the Integrity Checker Tool.
- More than 5,500 internet-exposed Connect Secure appliances were being tracked by Shadowserver when BleepingComputer reported the flaw.
- CVE-2026-109412, rated CVSS 9.9, could let a remotely authenticated attacker access sensitive authentication information in Neurons Patch for Intune. Ivanti deployed a cloud fix and recommends rotating the associated client secret.
- Five Xtraction vulnerabilities include CVE-2026-106042, rated CVSS 9.9, which can expose EPMM connector credentials to an attacker-controlled server.
- Xtraction 2026.2.1 and earlier is affected; Ivanti recommends upgrading to 2026.4 and rotating EPMM connector credentials. Other flaws enable file or directory access or modification, trusted-site changes, or SQL password exposure in logs.
- Ivanti said it was unaware of customers compromised through the Neurons Patch for Intune or Xtraction flaws at disclosure; no public proof-of-concept exploits for those vulnerabilities had been confirmed.
Article Details
- Vulnerability Types
- Authentication bypass
- Unauthenticated arbitrary command execution
- Credential exposure
- Sensitive authentication information access
- Server-side request redirection to an attacker-controlled server
- Path traversal enabling arbitrary file reads
- Unauthorized creation or modification of a trusted site
- Unauthorized directory modification
- SQL password exposure in application logs
- Severity
- CVSS 9.9 for CVE-2026-109412 and CVE-2026-106042; no severity rating stated for the other vulnerabilities.
- Affected Versions
- Connect Secure 22.8R2.4 and earlier
- Connect Secure 25.1.2.2 and earlier
- Connect Secure 25.1.1.1 and earlier
- Xtraction 2026.2.1 and earlier
- Exploitation Status
- active
- Exploit Availability
- unknown
- Patch Status
- available
- Workarounds
- For Neurons Patch for Intune, rotate the client secret associated with the Microsoft Entra ID application registration used for Intune publication.
- For Xtraction, rotate any EPMM connector credentials used by the application.
MITRE ATT&CK
CVE
CVE-2026-104935The actively exploited vulnerability, tracked as CVE-2026-104935, affects Ivanti Connect Secure remote-access gateways.CVE-2026-106034• CVE-2026-106034 allows authenticated users to modify directories.CVE-2026-106035• CVE-2026-106035 can expose SQL passwords through application logs.CVE-2026-106042The most serious, CVE-2026-106042, has a CVSS score of 9.9. An authenticated attacker can redirect application requests to an attacker-controlled server and capture EPMM connector credentials transmitted by Xtraction.CVE-2026-106043• CVE-2026-106043 allows an unauthenticated attacker to create or modify a trusted site.CVE-2026-106047• CVE-2026-106047 allows authenticated users to read arbitrary files through path traversal.CVE-2026-109412CVE-2026-109412 is a CVSS 9.9 vulnerability affecting Ivanti Neurons Patch for Intune, a cloud service used to manage third-party application updates through Microsoft Intune.
Vendors
Products
Connect SecureIvanti Patches Actively Exploited Connect Secure Zero-Day and Critical Credential-Leak FlawsMicrosoft Entra IDHowever, the company recommends rotating the client secret associated with the Microsoft Entra ID application registration used for Intune publication.Microsoft IntuneCVE-2026-109412 is a CVSS 9.9 vulnerability affecting Ivanti Neurons Patch for Intune, a cloud service used to manage third-party application updates through Microsoft Intune.Neurons Patch for IntuneIvanti has released security updates for an actively exploited Connect Secure zero-day and six additional vulnerabilities affecting Neurons Patch for Intune and Xtraction.XtractionIvanti has released security updates for an actively exploited Connect Secure zero-day and six additional vulnerabilities affecting Neurons Patch for Intune and Xtraction.