Ivanti Connect Secure zero-day exploited in real attacks

What happened

Cybersecurity and Infrastructure Security Agency (CISA) confirms exploitation in the wild, and added CVE-2026-104935 (the public catalogue number for a specific software flaw) to its Known Exploited Vulnerabilities (KEV) catalog on the same day as the vendor's public disclosure. The digital forensics firm Volexity has published a detailed blog post describing the threat actor (the person or group behind an attack) activity, which was detected in early October 2026.

Overview On October 13, 2026, Ivanti published a security advisory for CVE-2026-104935 , a high-severity authentication bypass by spoofing ( CWE-290 ) affecting Ivanti Connect Secure (ICS). The vulnerability has a CVSSv3.0 score of 8.6 and allows a remote, unauthenticated attacker to execute arbitrary commands.

Ivanti reports that exploitation in the wild has already occurred prior to disclosure, affecting a limited number of customers. This indicates that exploitation has been occurring as a zero-day (a flaw already being used in attacks before a fix exists) vulnerability.

Key facts

• Ivanti — reports: that exploitation in the wild has already occurred prior to disclosure, affecting a limited number of customers