Ivanti Connect Secure 0-Day Flaw Actively Exploited in the Wild to Execute Arbitrary Commands

Ivanti has disclosed an actively exploited zero-day vulnerability in Ivanti Connect Secure (ICS) that allows remote attackers to execute arbitrary commands without logging in.

Tracked as CVE-2026-104935, the flaw carries a high-severity CVSS score of 8.6. Ivanti confirmed that exploitation affected a limited number of customers in its October 13, 2026 advisory.

The vulnerability involves authentication bypass through spoofing, classified as CWE-290. An attacker can exploit the flaw over a network without credentials or user interaction.

Ivanti Connect Secure zero-day

The CVSS assessment indicates low attack complexity, with a high impact on data confidentiality and lower impacts on data integrity and service availability.

According to Ivanti, its product security team initially discovered part of the vulnerability and patched it in version 25.1.3.0, released in July 2026. Exploitation occurred while the company was working to bring the fix to other supported versions. Ivanti credited Volexity for helping protect affected customers.

The disclosure follows earlier Ivanti VPN exploitation and the MITRE network breach involving Ivanti zero-days. Those incidents involved different vulnerabilities and should not be treated as evidence of the methods used in this campaign.

Affected releases include 25.1.1.1 and earlier, 25.1.2.2 and earlier, and 22.8R2.4 and earlier. Ivanti lists 25.1.1.2, 25.1.3.0, 25.1.3.1, and 22.8R2.5 as resolved versions. Versions in the 22.7 branch and lower do not contain this vulnerability.

Customers using 25.1.1.1 on ISA6000 or ISA8000 appliances should install 25.1.1.2. Organizations running 22.8 should move to 25.1.1.2 or later, or install 22.8R2.5 if migration cannot happen immediately. Both 22.7 and 22.8 reach end of life on January 31, 2027.

Migration to 25.1.3.0 requires the ISA4500, ISA6500, or ISA8500 platform. Physical deployments need the new servers, while virtual and cloud deployments require newly built devices using the appropriate template.

Administrators should consult Ivanti’s upgrade and migration guide before changing platforms. Ivanti said it currently has no reliable indicators of compromise. Customers who suspect exploitation should follow its recovery instructions.

The advisory does not identify the attackers or provide exploit details, leaving the campaign’s scope beyond the confirmed customers unclear at disclosure.

An EDR alert reveals an attack. But can it tell the full story? Discover how to reconstruct the attack timeline.

The post Ivanti Connect Secure 0-Day Flaw Actively Exploited in the Wild to Execute Arbitrary Commands appeared first on Cyber Security News.