Critical 8.6Being exploited
Ivanti · Ivanti Connect Secure · CVE-2026-104935
Ivanti Connect Secure VPN zero-day lets attackers run commands without logging in
An authentication bypass lets a remote, unauthenticated attacker run commands on Ivanti Connect Secure VPN appliances. Volexity found it being chained with other flaws since early October to get root access, with the attacker leaving no malware and tampering with logs. A privilege escalation flaw used in the same chain is not yet patched, and Ivanti says reliable indicators of compromise are not available.
- Affected
- Ivanti Connect Secure 25.1.1.1 and earlier, 25.1.2.2 and earlier, and 22.8R2.4 and earlier. Versions 22.7R2.14 and earlier are not affected.
- What to do
- Update to 25.1.1.2, 25.1.3.0 or 25.1.3.1, or 22.8R2.5, depending on your code line. Check for signs of compromise even after patching, as CISA notes Ivanti's Integrity Checker Tool may not see this activity.General information summarised from the vendor's advisory at the time of writing, not professional advice. Check the vendor's current advisory before acting.
- Why it’s here
- Exploited as a zero-day; on CISA's KEV list; SSL VPNs like this are how many small offices give staff remote access.