Ivanti Connect Secure Zero Day Exploited in Attacks

Posted By Steve Alder on Oct 14, 2026

A high-severity authentication bypass vulnerability has been identified in the Ivanti Connect Secure (Pulse Connect Secure) enterprise-grade SSL VPN that can allow a remote, unauthenticated malicious actor to execute arbitrary commands, steal credentials, and exfiltrate sensitive data.

Researchers at the cybersecurity firm Volexity identified in-the-wild exploitation of a vulnerability chain involving the authentication bypass vulnerability in the first week of October. The threat actor was able to compromise a fully patched ICS VPN appliance and achieve remote, root-level code execution. The vulnerability has been exploited by malicious actors on limited ICS customers and has been added to CISA’s Known Exploited Vulnerability (KEV) Catalog.

Volexity determined that the threat actor exploited three zero-day vulnerabilities in the attack, including the authentication bypass vulnerability and a remote code execution vulnerability, which are jointly tracked as CVE-2026-104935. The vulnerability has a CVSS v3.1 base score of 8.6. Ivanti says the vulnerability has been exploited by malicious actors onlimited ICS customers, and has been added to CISA’s Known Exploited Vulnerability (KEV) Catalog. The third zero-day is a privilege escalation vulnerability, which has yet to be patched. Ivanti is working on a patch to fix that flaw, which will be addressed in a future release.

The CVE-2026-104935 vulnerability affects the following Ivanti Connect Secure (ICS) versions, and patches have been released to fix the flaws. Customers are also advised to run the Integrity Checker Tool regularly.

Get The FREE
HIPAA Compliance Checklist

Immediate Delivery of Checklist Link To Your Email Address

Business Email *

Name *

First

Last

Number *

Company Name *

Get Free Checklist

Please Enter Correct Email Address

Your Privacy Respected

HIPAA Journal Privacy Policy

Limited indicators of compromise have been identified by Volexity and are detailed in its blog post.