Actively Exploited Zero-Day Vulnerability in Ivanti Connect Secure Gateways

On October 13, 2026, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) issued a security alert regarding a critical zero-day vulnerability affecting Ivanti Connect Secure VPN gateways, which has been confirmed to be actively exploited in the wild.

Tracked as CVE-2026-104935, with a CVSS score of 8.6 (High), the vulnerability affects Ivanti Connect Secure versions 25.1.1.1, 25.1.2.2, and 22.8R2.4, as well as earlier affected releases within the respective version branches.

This authentication bypass vulnerability allows remote attackers to execute commands on affected devices without authentication.

Credential theft and data exfiltration activities have been observed in attacks exploiting this vulnerability. Successful exploitation can pose significant risks to corporate VPN infrastructure and internal network resources.

CISA recommends that affected organizations promptly apply security updates, investigate potential indicators of compromise (IoCs), and follow the vendor's recovery procedures for devices suspected of being compromised.

Some of the measures we need to take to protect against these types of critical VPN and perimeter security attacks are;

• Apply security updates: Promptly install the latest security patches released by Ivanti.

• Strengthen access security: Restrict access to management interfaces and enforce multi-factor authentication (MFA) wherever possible.

• Monitor security logs: Review unauthorized access attempts, suspicious sessions, and abnormal VPN connections.

• Perform compromise assessments: Use vendor-provided integrity checking tools to identify potential indicators of compromise.

• Follow incident recovery procedures: Securely rebuild compromised devices and rotate affected passwords and certificates.

For detailed information, you can contact our experts at info@zerosecond.ae.