A high-severity authentication bypass vulnerability has been identified in the Ivanti Connect Secure (Pulse Connect Secure) enterprise-grade SSL VPN that can allow a remote, unauthenticated malicious actor to execute arbitrary commands, steal credentials, and exfiltrate sensitive data. Researchers at the cybersecurity firm Volexity identified in-the-wild exploitation of a vulnerability chain involving the authentication bypass vulnerability in the first week of October.
The threat actor was able to compromise a fully patched ICS VPN appliance and achieve remote, root-level code execution. The vulnerability has been exploited by malicious actors on limited ICS customers and has been added to CISA’s Known Exploited Vulnerability (KEV) Catalog. Volexity determined that the threat actor exploited three zero-day vulnerabilities in the attack, including the authentication bypass vulnerability and a remote code execution vulnerability, which are jointly tracked as CVE-2026-104935 .
The vulnerability has a CVSS v3. 1 base score of 8. 6.
Ivanti says the vulnerability has been exploited by malicious actors onlimited ICS customers, and has been added to CISA’s Known Exploited Vulnerability (KEV) Catalog. The third zero-day is a privilege escalation vulnerability, which has yet to be patched. Ivanti is working on a patch to fix that flaw, which will be addressed in a future release.
The CVE-2026-104935 vulnerability affects the following Ivanti Connect Secure (ICS) versions, and patches have been released to fix the flaws. Customers are also advised to run the Integrity Checker Tool regularly. Get The FREE HIPAA Compliance Checklist Immediate Delivery of Checklist Link To Your Email Address Please enable JavaScript in your browser to complete this form.
Business Email * Name * First Last Number * Company Name * Get Free Checklist Please Enter Correct Email Address Your Privacy Respected HIPAA Journal Privacy Policy Affected Versions Fixed versions 25. 1. 1.
1 and prior 25. 1. 1.
2 25. 1. 2.
2 and prior 25. 1. 3.
0, 25. 1. 3.
1 22. 8R2. 4 and prior 22.
8R2. 5 Limited indicators of compromise have been identified by Volexity and are detailed in its blog post . The post Ivanti Connect Secure Zero Day Exploited in Attacks appeared first on The HIPAA Journal .
Originally published at hipaajournal.com
