Ivanti urges immediate patching for Connect Secure zero-day

The flaw lets attackers run commands on exposed appliances without credentials or user action, and Ivanti says it is already seeing limited abuse.

Ivanti says customers should patch an actively exploited zero-day in Connect Secure right away, because attackers can use it to run commands on exposed appliances without needing credentials or user interaction. The flaw is CVE-2026-104935, a high-severity authentication bypass reported by Volexity, and it affects ICS 22.8R2.4 and earlier, 25.1.2.2 and earlier, and 25.1.1.1 and earlier. Ivanti says it has seen limited exploitation in the wild and is sharing fixes and remediation guidance with affected customers. Shadowserver reports more than 5,500 Connect Secure instances exposed online, though it is not clear how many are honeypots or already protected.