Ivanti Connect Secure: a zero-day under attack, the vendor warns

On Tuesday 13 October 2026, Ivanti published a security advisory for Ivanti Connect Secure (ICS), its SSL VPN remote access gateway. The product has changed names more often than its owners have changed patches: it used to be Pulse Connect Secure, and before that Juniper Pulse. One caveat before we go any further: all of this comes from a single source, Bleeping Computer’s article, which relays the vendor’s advisory. Treat the details below as provisional and check them against Ivanti’s official advisory, which is the one that counts.

What the flaw reportedly allows

The vulnerability is tracked as CVE-2026-104935. Bleeping Computer describes it as a high-severity authentication bypass, reported by the security firm Volexity. Going by that description, a remote attacker with no privileges could exploit it through a low-complexity attack, with no user interaction at all, and run arbitrary commands on the targeted device. In other words, nobody has to click anything, and nobody has to be clever.

Ivanti reportedly says it is aware of limited exploitation at the time of disclosure and is working directly with the affected organisations. The vendor tells customers running an affected version to act immediately. That makes it a zero-day: attackers were using it before a fix existed.

Affected versions and the update

According to the source, the affected versions are:

• 22.8R2.4 and earlier;
• 25.1.2.2 and earlier;
• 25.1.1.1 and earlier.

Bleeping Computer’s article does not give the fixed version numbers. Ivanti asks customers to check its advisory and move to the patched release as soon as possible. We are not printing a version number the source doesn’t give: it’s the one line you’re going to copy and paste, and a wrong number there would do more damage than a missing one. Check Ivanti’s official advisory to find out which version to install on each branch.

The exposure is significant: according to Bleeping Computer, the Shadowserver organisation tracks more than 5,500 ICS instances reachable from the Internet. How many of them are honeypots, or have already been protected, is anyone’s guess.

Checking whether your gateway was compromised

On top of the update, Ivanti recommends running its Integrity Checker Tool on a regular basis. The patch stops anyone new from getting in, but it tells you nothing about anyone who already did. Since the flaw was exploited before it was disclosed, a gateway you patch today could still have been breached last week.

The source does not publish any indicators of compromise. If the tool flags an anomaly, or if your device sat on the Internet running an affected version, contact Ivanti and your incident response team.

A long-running series

This is not the product’s first flaw of this kind, and it isn’t even its second. Bleeping Computer notes that Ivanti vulnerabilities are frequently exploited, often as zero-days, because they offer a quick way into corporate networks. In January 2024, the vendor fixed an authentication bypass (CVE-2023-46805) and a command injection (CVE-2024-21887), then a server-side request forgery (CVE-2024-21893) two weeks later. January 2025 brought a remote code execution flaw (CVE-2025-0282), followed by a second one (CVE-2025-22457), exploited since at least mid-March 2025 by China-linked espionage groups, according to the source.

Again according to Bleeping Computer, the US agency CISA has listed 36 vulnerabilities in Ivanti products as actively exploited since November 2021, 12 of which were also used by ransomware gangs. Ivanti claims more than 40,000 customers worldwide.

A VPN gateway is the front door to your network. Patching changes the locks; you still need to check whether someone let themselves in while the old ones were broken.