Ivanti urged its customers to immediately update the Ivanti Connect Secure remote access gateway after disclosing zero-day vulnerability CVE-2026-104935, a high-severity authentication bypass vulnerability being exploited in real-world attacks. The vulnerability affects versions 22.8R2.4 and earlier, 25.1.2.2 and earlier, and 25.1.1.1 and earlier.
The vulnerability enables unauthorized attackers to execute arbitrary commands on targeted devices through low-complexity attacks that require no user interaction. Connect Secure, formerly known as Pulse Connect Secure and before that as Juniper Pulse, is used to provide secure access for employees, contractors, and hybrid teams to corporate resources and cloud services.
Multistage Exploitation
Ivanti said it observed limited exploitation of the vulnerability in the wild at the time of disclosure and urged customers to review the security advisory, upgrade to a fixed version, and run the Integrity Checker tool regularly. However, Volexity, which discovered and reported the vulnerability, said an unidentified threat actor it tracks as UTA0576 had been using it since at least October 3, linking it to two additional vulnerabilities to execute code with root privileges without authentication, even on fully updated devices.
According to Volexity, the attacking party did not plant persistent malware or web shells; instead, it re-exploited the device to execute each command, tampered with logs to conceal its tracks, and managed to bypass Ivanti's Integrity Checker tool. Defused said it observed the first indicators of exploitation of the vulnerability in the wild on October 1.
What Changes in Practice?
The risk is not limited to installing the patch for the current vulnerability, as Ivanti indicated that it is still working to address a privilege escalation vulnerability used as part of the same chain. Operators of affected devices therefore need to follow the complete security advisory, verify the integrity of systems and logs, and not consider passing the Integrity Checker alone sufficient evidence that a device has not been tampered with.
Shadowserver is tracking more than 5,500 Connect Secure instances exposed to the internet, with no available information identifying how many devices represent honeypots or have already been secured. This increases the importance of identifying exposed assets and prioritizing their upgrades, particularly because remote access gateways sit at the boundary between the internet and enterprise networks.
A Recurring Context for a Targeted Product
In recent years, Ivanti has fixed several zero-day vulnerabilities in Connect Secure that were exploited in attacks, including CVE-2023-46805 and CVE-2024-21887 in January 2024, and CVE-2024-21893 later that same month, in addition to the remote code execution vulnerabilities CVE-2025-0282 and CVE-2025-22457 in 2025. The U.S. Cybersecurity and Infrastructure Security Agency, CISA, has also counted 36 vulnerabilities in Ivanti products that have been exploited in the wild since November 2021; ransomware gangs misused 12 of them.
certi.news analysis: The actual change here is the transition of an authentication bypass vulnerability from disclosure to practical exploitation that gives an attacker the ability to execute commands with elevated privileges, with indications of techniques that help evade verification tools. The scope of exploitation and the number of devices actually compromised remain unresolved, making updates and forensic verification of affected systems parallel steps, neither of which can replace the other.