Ivanti patches Connect Secure zero-day after researchers confirm in-the-wild attacks

Ivanti customers are being urged to update Connect Secure and check for compromise after attackers exploited a newly disclosed zero-day vulnerability. On Tuesday, Ivanti released updates for Connect Secure (ICS) to fix CVE-2026-104935, an authentication bypass flaw discovered by Volexity. Rated 8.6 on the CVSS scale, it allows remote, unauthenticated attackers to execute arbitrary commands. "We are aware of exploitation in the wild affecting a limited number of customers at the time of disclosure," the vendor said in its advisory. There are limited indicators of compromise available at present, it said, advising customers to refer to Volexity's report on the findings for more information, and to run the Ivanti Integrity Checker Tool regularly. …