# Ivanti Connect Secure zero-day exploited in wild

Published: 2026-10-13 · Severity: severe · Sectors: government-national, technology
Canonical: https://vorant.io/reports/dcfd5680-521f-5347-9cba-d0ad64f00647/ivanti-connect-secure-zero-day-exploited-in-wild

> An authentication bypass in Ivanti Connect Secure allows unauthenticated remote code execution and is being actively exploited.

CIS/MS-ISAC issued an advisory for CVE-2026-104935, an authentication bypass by spoofing vulnerability in Ivanti Connect Secure (ICS), an enterprise SSL VPN and zero-trust remote access gateway. The flaw allows a remote, unauthenticated attacker to execute arbitrary commands on the system, potentially leading to full compromise including installing programs and viewing, modifying, or deleting data. Ivanti has confirmed the vulnerability is being exploited in the wild.

Affected versions include ICS 25.1.1.1 and prior, 25.1.2.2 and prior, and 22.8R2.4 and prior; versions 22.7R2.14 and prior are not impacted. Ivanti has released patched versions 25.1.1.2, 25.1.3.0/25.1.3.1, and 22.8R2.5, and recommends customers on the 22.8 branch upgrade to 25.1.1.2 or later ahead of that branch's end-of-life on January 31, 2027. Given ICS's role as an internet-facing remote access gateway and the active exploitation, this represents a significant and urgent risk for any organization running affected versions.

Defenders should prioritize immediate patching after testing, following vendor guidance, and apply standard hardening measures such as network segmentation, least privilege, vulnerability scanning, and exploit protection as outlined in the advisory's CIS Safeguards. Given the history of Ivanti Connect Secure/Pulse Secure devices being targeted by sophisticated threat actors for initial access into enterprise and government networks, organizations should also review logs for signs of prior compromise.

## Mentioned in this report

- Vulnerabilities: CVE-2026-104935 (KEV)

Source reporting: https://www.cisecurity.org/advisory/a-vulnerability-in-ivanti-connect-secure-could-allow-for-arbitrary-code-execution_2026-115

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/dcfd5680-521f-5347-9cba-d0ad64f00647/ivanti-connect-secure-zero-day-exploited-in-wild.
In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), live profiles of the actors and CVEs it names, and the vendor research on the same campaign. Slack alerts fire on the vendors, sectors and countries a reader follows. A new account starts with three days of all of it, no card: https://vorant.io/signup