What Happened

Ivanti disclosed a zero-day vulnerability (CVE-2026-104935) in its Connect Secure product that is being actively exploited in the wild. The flaw allows unauthenticated remote attackers to execute arbitrary commands on vulnerable systems. Ivanti assigned a CVSS score of 8.6, and the Dutch National Cyber Security Centre (NCSC) rates both the likelihood of exploitation and potential damage as high.

Who Is Affected

Organizations using Ivanti Connect Secure versions prior to 22.8R2.5 or 25.1.1.2 are affected. Ivanti states that version 22.7R2.14 and older are not vulnerable. Customers on the 22.8 series should upgrade to 25.1.1.2 or later; if that is not possible, version 22.8R2.5 also fixes the issue. Ivanti reports that a limited number of customers have already been compromised.

Market Impact

• Active exploitation before disclosure increases urgency for patching and incident response.
• Because Connect Secure provides remote access to internal systems, a successful breach can lead to lateral movement and data compromise.
• NCSC's high damage rating suggests potential for widespread impact across affected organizations.
• Security vendors and MSSPs have a time-sensitive opportunity to engage customers with emergency support.

What to Watch

Monitor for additional details on the attack vector and any indicators of compromise released by Ivanti or NCSC. Organizations that suspect a breach must follow Ivanti's remediation steps, as simply applying the patch does not undo prior compromise. Further exploitation attempts may increase as the vulnerability becomes more widely known.

Related coverage

• Ivanti Connect Secure VPN Zero-Day Actively Exploited; CISA Adds to KEV Catalog
• GitLab Issues Critical Patch for CVSS 10.0 RCE Vulnerability CVE-2026-97229
• Critical CVE-2026-91140 in Progress DataDirect ARCGenAI Agents Patched
• Citrix Releases Emergency Patch for Actively Exploited NetScaler DoS Vulnerability CVE-2026-88779