Ivanti has disclosed an actively exploited vulnerability in Connect Secure appliances that can allow a remote attacker to run arbitrary commands without authenticating. The zero-day, CVE-2026-104935, has a CVSS score of 8.6 and affected a limited number of customers before fixes were available across supported product branches.

Connect Secure devices often sit at a sensitive boundary between the internet and internal resources. A pre-authentication flaw on that boundary deserves immediate attention because an adversary does not need a valid account or cooperation from a user to begin an attack.

A network attack with no credentials required

The vulnerability is categorized as an authentication bypass through spoofing, or CWE-290. According to Ivanti’s assessment, exploitation can occur remotely with low attack complexity, no privileges and no user interaction. Successful exploitation may expose confidential data and can also affect integrity and availability.

Ivanti’s product security team found part of the problem and addressed it in version 25.1.3.0 in July 2026. The company says exploitation happened while it was extending the correction to other supported versions. Volexity was credited for assisting in the protection of affected customers.

The advisory does not name the attackers, describe their objectives, or publish exploit code. Ivanti also says it does not currently have reliable indicators of compromise that customers can simply search for. That makes patching and careful appliance review more important, not less: defenders cannot rely on one signature to establish whether a device is clean.

Affected and corrected releases

Ivanti lists multiple release lines in its guidance. Versions 25.1.1.1 and earlier, 25.1.2.2 and earlier, and 22.8R2.4 and earlier are affected. Corrected versions include 25.1.1.2, 25.1.3.0, 25.1.3.1 and 22.8R2.5. The older 22.7 branch and below do not contain this particular vulnerability, although using an older branch can introduce separate lifecycle and security concerns.

Customers running 25.1.1.1 on ISA6000 or ISA8000 appliances should install 25.1.1.2. Organizations on the 22.8 line can install 22.8R2.5 when an immediate platform migration is not possible, or move to 25.1.1.2 or later. Ivanti says both 22.7 and 22.8 reach end of life on January 31, 2027.

A move to 25.1.3.0 has hardware and deployment implications. Physical environments require ISA4500, ISA6500 or ISA8500 systems, while virtual and cloud deployments need newly built devices created from the correct template. Administrators should therefore follow Ivanti’s migration documentation rather than treating this as a routine in-place update.

How defenders should respond

• Inventory every Connect Secure instance, including standby, disaster-recovery and cloud deployments.
• Map each appliance to Ivanti’s affected-version table and deploy a corrected release as soon as operationally possible.
• Restrict management access and unnecessary network exposure while remediation is in progress.
• Review appliance, identity, VPN and downstream network telemetry for anomalous sessions or commands.
• If compromise is suspected, follow Ivanti’s recovery instructions rather than assuming an upgrade removes attacker persistence.

Because vendor-provided indicators are not currently reliable, incident responders should look for behavior across multiple data sources. Unexpected configuration changes, newly created accounts, abnormal outbound connections and unusual access from the appliance into internal systems may all merit investigation. Baseline comparisons can be useful when trustworthy historical records exist.

Do not confuse this campaign with earlier Ivanti incidents

Ivanti remote-access products have faced exploitation in previous years, but earlier vulnerabilities and breaches do not prove that the same actors or methods are involved here. Teams should keep the cases separate unless technical evidence connects them.

Cyber Security News reports that the company has confirmed exploitation at a limited number of customers. For everyone else, that is an early warning: reduce exposure, install a fixed release, and prepare to rebuild or recover the appliance if forensic evidence suggests it was accessed before remediation.