Ivanti Connect Secure Zero-Day Exploited in Attacks

Ivanti is warning of a high-severity flaw in Ivanti Connect Secure, which is currently being exploited in the wild by threat actors. 

The flaw (CVE-2026-104935) stems from an authentication bypass in Ivanti’s enterprise VPN appliance (formerly known as Pulse Connect Secure). Attackers can exploit the flaw via spoofing before version 25.1.3.0, according to Ivanti.

“Successful exploitation could allow a remote unauthenticated attacker to execute arbitrary commands,” according to Ivanti’s Tuesday security advisory. “We are aware of exploitation in the wild affecting a limited number of customers at the time of disclosure.”

Ivanti has released fixes: Both the vendor and CISA are urging businesses vulnerable to CVE-2026-104935 to update their appliances to resolved versions as soon as possible.  A full table of impacted versions is below and can also be found on Ivanti’s website. 

Exploitation activity was outlined Tuesday in an analysis by Volexity. Volexity said that on October 5, researchers first uncovered an unknown threat actor abusing a zero-day exploit chain – including an authentication bypass and RCE (both tracked under CVE-2026-104935). 

The chain also involved a privilege escalation flaw, and allowed the attackers to achieve unauthenticated root-level code execution on an Ivanti Connect Secure appliance. According to Volexity, Ivanti is working on a fix for the privilege escalation bug. It will be released in the coming weeks.

After conducting a forensic investigation, researchers found that the activity started on October 3 and was focused on credential theft (specifically credentials stored in the VPN appliance, like domain credentials used with LDAP), data exfiltration, network reconnaissance, and various anti-forensics techniques (including log tampering and payload self-deletion). 

“Volexity identified a range of post-exploitation actions undertaken by the threat actor that targeted Active Directory credentials and secrets, including Local Administrator Password Solution (LAPS) passwords and BitLocker recovery keys,” according to Volexity. 

The campaign was disrupted before it could proceed, but researchers believe that threat actors were preparing for lateral movement and a broader compromise of the environment. Researchers also pointed to the attacker’s use of LLMs for post-exploitation activity.

“This assessment is based on the continuous use of the exploit channel to pass commands to the compromised host (rather than a simpler method such as a web shell), the repeated deployment of highly specific scripts using hardcoded credentials (rather than generic pre-built utilities), and the complexity of the exploit chain,” according to researchers.