Ivanti Connect Secure Vulnerability Exploited in Wild
A new remote code execution flaw allows unauthenticated attackers to run arbitrary commands on exposed devices.
Updated on Oct. 14, 2026 in Cybersecurity
Live Poll
Do you feel that your personal digital information is becoming less secure online?
Ivanti Connect Secure has been found to contain a critical remote code execution vulnerability, identified as CVE-2026-104935. The flaw enables remote, unauthenticated attackers to bypass security restrictions and execute arbitrary commands.
Why it matters
The active exploitation of this vulnerability poses a severe threat to network security for organizations relying on Ivanti infrastructure. Because the flaw allows for authentication bypass and remote command execution, it effectively grants attackers broad control over affected gateways.
The vulnerability, tracked as CVE-2026-104935, is classified as Extremely High Risk due to its ability to facilitate remote code execution. It relies on an authentication bypass mechanism that permits unauthenticated actors to send commands to the system.
The players
Ivanti
A software company specializing in IT asset management and secure access solutions that maintains the Connect Secure product line.
The details
The flaw functions by allowing an attacker to spoof authentication headers, effectively bypassing the security handshake required to enter the system. Once authentication is spoofed, the attacker can execute arbitrary commands directly on the host, essentially granting them the same permissions as an authorized administrator. This process leverages the underlying trust mechanisms built into the Ivanti Connect Secure software architecture to facilitate unauthorized access.
Timeline
- 2026-10-14
The vulnerability was identified and an official bulletin was published.
The Tech Race
This incident follows a pattern established by the 2024 Ivanti Connect Secure authentication bypass surge, where similar flaws targeted the same infrastructure. It highlights the ongoing struggle to secure edge-network gateways against persistent, unauthenticated remote access attempts.
Network administrators and security teams must monitor for signs of unauthorized command execution across their deployments. The immediate remediation steps depend on forthcoming security patches or configuration guidance from the vendor.
The takeaway
Organizations should review their exposure to external-facing VPN and gateway devices to mitigate risks while awaiting formal guidance. Watch for updated security bulletins from the vendor to confirm the arrival of a patch or mitigation protocol.
Further reading
For broader trends in network security and vulnerability management, visit our Cybersecurity section.
Live Poll
Do you feel that your personal digital information is becoming less secure online?
