Source: BleepingComputer
Ivanti has told customers to patch immediately after disclosing CVE-2026-104935, a high-severity authentication bypass zero-day in the Connect Secure SSL VPN gateway. The flaw affects versions 22.8R2.4 and earlier, 25.1.2.2 and earlier, and 25.1.1.1 and earlier, and lets a remote attacker without privileges execute arbitrary commands on exposed appliances in low-complexity attacks that require no user interaction. Ivanti says it is aware of limited exploitation in the wild and is working directly with affected organisations. Shadowserver currently tracks more than 5,500 Connect Secure instances exposed to the internet.
A chain that defeats fully patched appliances
Volexity, which found and reported the flaw, says a previously unknown threat actor it tracks as UTA0576 has chained CVE-2026-104935 with two other vulnerabilities since at least 3 October to reach unauthenticated root-level code execution on fully patched devices. What makes this campaign unusual is the tradecraft. The attacker deployed no malware and no web shell, instead re-exploiting the appliance for every command and tampering with logs to cover its tracks, which evaded Ivanti’s own Integrity Checker Tool. While Ivanti has patched two of the flaws, a privilege escalation vulnerability used in the same chain is still being worked on. CISA has added CVE-2026-104935 to its Known Exploited Vulnerabilities Catalog, and Defused has seen in-the-wild exploitation dating back to 1 October.
Why this matters for European enterprises
Connect Secure appliances are a favourite initial-access vector precisely because they sit at the network edge and terminate VPN sessions for remote workforces, and Ivanti products have been repeatedly hit by zero-day campaigns since 2024, some of them linked to Chinese espionage groups. European organisations running Connect Secure should upgrade to a fixed version now, run the Integrity Checker Tool regularly, and treat any appliance exposed since 1 October as suspect until forensic review says otherwise. Given that the attacker deliberately evades Ivanti’s own detection tooling, a compromise assessment by an independent team is a sensible precaution for high-risk environments.
If your organisation runs Ivanti Connect Secure and you want help patching, validating appliance integrity or investigating suspicious activity before attackers get comfortable, contact Excello Digital at https://excello.digital/contact/. We help European businesses secure their remote access estate with an evidence-based approach your auditors will accept.