Science & Tech · Cybersecurity · 2 hrs ago
Ivanti warns of actively exploited Connect Secure security flaw
Ivanti says attackers are exploiting a serious flaw in its Connect Secure remote access gateway.
The gateway lets employees and contractors connect securely to company and cloud systems from outside the workplace.
The flaw bypasses authentication, so attackers do not need an account or user interaction to run commands on affected devices.
Ivanti said it had seen limited exploitation when it disclosed the issue, which was reported by cybersecurity firm Volexity.
More than 5,500 Connect Secure devices are tracked as exposed online, though it is not known how many are already secured or are monitoring systems.
Ivanti urges customers to upgrade to a fixed version immediately and regularly run its Integrity Checker Tool.
The company says it is working with affected organizations and making updates and remediation information available to other customers.
Ivanti urged customers to immediately patch a high-severity zero-day vulnerability in its Connect Secure remote access gateway.
The flaw, tracked as CVE-2026-104935, allows remote attackers without privileges to bypass authentication and execute arbitrary commands.
Ivanti said it was aware of limited exploitation in the wild at the time of disclosure.
The vulnerability affects several Connect Secure versions, including versions 22.8R2.4 and earlier.
Shadowserver tracks more than 5,500 Connect Secure instances exposed online, though it is unclear how many are secured or honeypots.
- Who
- Ivanti and customers using Ivanti Connect Secure; remote threat actors are exploiting the flaw.
- What
- Ivanti warned of an actively exploited authentication-bypass zero-day and urged customers to patch.
- When
- Ivanti issued the warning on Tuesday; the article was published on October 13, 2026.
- Where
- The flaw affects Ivanti Connect Secure appliances, including internet-exposed instances.
- Why
- The flaw can let attackers without privileges execute arbitrary commands on targeted appliances.
This story does not have two clearly opposing sides.
This story does not have a timeline yet.
- Vulnerability
- CVE-2026-104935
- Severity
- High
- Affected versions
- 22.8R2.4 and earlier; 25.1.2.2 and earlier; 25.1.1.1 and earlier
- Exposed instances
- More than 5,500 Connect Secure instances tracked by Shadowserver
- Reporter
- Cybersecurity firm Volexity
What people are saying
At the time of disclosure, Ivanti is aware of limited exploitation in the wild.
If you are running one of the impacted versions, Ivanti recommends you act immediately,
Customers should review the security advisory, upgrade to the fixed version as soon as possible, and run the Integrity Checker Tool regularly.
Sources
Related news
Cyberattack disrupts IT systems at three TFG London fashion brands
Canadian cybersecurity executive arrested in ShinyHunters investigation
Cyberattack disrupts refrigeration at hundreds of French supermarkets
Norway fines Microsoft-owned Xandr $9.6 million over Grindr data sharing
GitLab fixes maximum-severity flaw that could let attackers run server code
Ledger links CryptoBilis wallet implants to confirmed crypto thefts
DDoS attack disrupts Canonical websites for more than four hours
GitHub adds 48-hour limit after npm publishing flaw exposed 1,500 packages
Survey finds human error is the leading cybersecurity concern
Ahold Delhaize takes systems offline after cybersecurity incident
Cyberattacks target refrigeration systems at more French supermarkets
