Ivanti

Security researchers are warning organizations to patch Ivanti Connect Secure VPN appliances immediately after disclosure of CVE-2026-104935, a critical authentication bypass flaw. The vulnerability is said to allow remote attackers to execute commands and steal credentials without valid authentication. Security commentators are urging rapid patching, reflecting Ivanti's history of heavily exploited VPN vulnerabilities.

Attackers are exploiting a vulnerability in Ivanti Connect Secure to gain access to networks without needing valid accounts. Security outlet CSO Online reports that the flaw lets hackers bypass authentication entirely, raising concerns for organisations relying on the remote access product. Administrators are being urged to patch and review their systems for signs of compromise.

Security researchers report that vulnerability CVE-2026-104935 in Ivanti Connect Secure is being actively exploited, allowing unauthenticated attackers to run arbitrary commands on affected systems. Users are being urged to patch immediately to version 25.1.1.2 or later. The flaw affects a widely used enterprise VPN appliance, raising concerns about potential mass compromise of corporate networks.

Ivanti is facing scrutiny after reports that the company failed to fix a vulnerability before attackers began exploiting it, turning the flaw into a zero-day. Security outlets report the opportunity to patch existed but was missed, leaving customers exposed to active attacks. The case adds to ongoing concerns about Ivanti's patching record and the risks enterprises face from delayed vulnerability remediation in widely used enterprise software.

Security researchers are warning about a critical vulnerability in Ivanti Connect Secure, tracked as CVE-2026-104935, that is being chained in zero-day attacks. Attackers reportedly exploit the flaw to gain root access on affected appliances and steal network secrets. Cybersecurity commentators are urging organisations using Ivanti gateways to review exposure and patch as updates become available.

A new zero-day in Ivanti Connect Secure, tracked as CVE-2026-104935 with a CVSS score of 8.6, is being actively exploited. The flaw allows authentication bypass via spoofing, leading to unauthenticated remote code execution on the VPN appliance. The threat has been added to CISA's Known Exploited Vulnerabilities catalog. Security firm Volexity documented threat actor UTA0576 chaining three vulnerabilities to gain root access on a fully patched appliance, using a memory-only attack that leaves no backdoor on disk.

A threat brief from Ninja Intelligence Group claims Ivanti Connect Secure appliances have been rooted even when fully patched, with one of three known vulnerabilities still unpatched. The report is circulating among cybersecurity and threat intelligence professionals who are treating the alleged bypass as a serious concern for enterprise VPN security.