Ivanti Connect Secure zero-day exploited in wild
Free public brief. The indicators, the detections with Splunk SPL already written (plus Elastic and KQL where they apply), and a Slack alert the next time this touches a vendor you run are in the app — free account, no card.
An authentication bypass in Ivanti Connect Secure allows unauthenticated remote code execution and is being actively exploited.
CIS/MS-ISAC issued an advisory for CVE-2026-104935, an authentication bypass by spoofing vulnerability in Ivanti Connect Secure (ICS), an enterprise SSL VPN and zero-trust remote access gateway. The flaw allows a remote, unauthenticated attacker to execute arbitrary commands on the system, potentially leading to full compromise including installing programs and viewing, modifying, or deleting data. Ivanti has confirmed the vulnerability is being exploited in the wild.
Affected versions include ICS 25.1.1.1 and prior, 25.1.2.2 and prior, and 22.8R2.4 and prior; versions 22.7R2.14 and prior are not impacted. Ivanti has released patched versions 25.1.1.2, 25.1.3.0/25.1.3.1, and 22.8R2.5, and recommends customers on the 22.8 branch upgrade to 25.1.1.2 or later ahead of that branch's end-of-life on January 31, 2027. Given ICS's role as an internet-facing remote access gateway and the active exploitation, this represents a significant and urgent risk for any organization running affected versions.
Defenders should prioritize immediate patching after testing, following vendor guidance, and apply standard hardening measures such as network segmentation, least privilege, vulnerability scanning, and exploit protection as outlined in the advisory's CIS Safeguards. Given the history of Ivanti Connect Secure/Pulse Secure devices being targeted by sophisticated threat actors for initial access into enterprise and government networks, organizations should also review logs for signs of prior compromise.
Mentioned in this report
Source reporting: https://www.cisecurity.org/advisory/a-vulnerability-in-ivanti-connect-secure-could-allow-for-arbitrary-code-execution_2026-115
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), the actors and CVEs it names as live profiles, and the vendor research on the same campaign — the primary source the news paraphrased, cited and read directly.
It sits in a corpus of 13,854 reports from 146 sources, 616 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Name the vendors you run and Slack hears about the reports that touch them — about forty a week that are yours, not the four hundred that are not.
Create a free account What it costs