Ivanti warns of exploited Connect Secure zero-day

Ivanti urged customers to immediately patch an actively exploited zero-day in Ivanti Connect Secure, tracked as CVE-2026-104935. The high-severity authentication bypass lets unauthenticated attackers run arbitrary commands without user interaction and affects ICS versions 22.8R2.4, 25.1.2.2 and 25.1.1.1 and earlier.

• CVE-2026-104935 is a high-severity auth bypass in Ivanti Connect Secure
• Affected versions include 22.8R2.4, 25.1.2.2 and 25.1.1.1 and earlier
• Exploitation needs no privileges and no user interaction
• Shadowserver tracks over 5,500 ICS instances exposed online