Ivanti has released patches for a critical authentication bypass vulnerability in Connect Secure, identified as CVE-2026-104935, after confirming attackers exploited it in live environments.

The flaw, rated 8.6 on the CVSS scale, permitted remote, unauthenticated access to execute arbitrary commands on affected systems. Volexity researchers discovered the vulnerability and reported active exploitation targeting a limited number of customers prior to Ivanti's disclosure. The company's advisory noted limited indicators of compromise and directed users to Volexity's analysis for mitigation guidance.

Affected versions included 25.1.1.1 and earlier, 25.1.2.2 and earlier, and 22.8R2.4 and earlier. Ivanti confirmed prior awareness of the vulnerability, having patched a related component in July 2025 updates, but attackers began exploiting it before a full fix could be deployed. Volexity attributed the attacks to an unnamed group now tracked as UTA0576, with suspected criminal motives rather than espionage. Observed activities included credential theft, data exfiltration, and network reconnaissance, though no malware or web shells were deployed.

Researchers noted unusual command-line usage patterns and hardcoded credential scripts, suggesting potential use of large language models for attack automation. Volexity described a multi-stage attack chain involving three distinct vulnerabilities, with the patched flaw handling initial access and remote code execution. A separate privilege escalation vulnerability, unrelated to CVE-2026-104935, remains under investigation with a fix expected in the coming weeks.

This incident marks the third consecutive year Ivanti has addressed zero-day exploits in Connect Secure, following disclosures in January 2025 and earlier incidents linked to thousands of compromised appliances. The company also faces ongoing scrutiny over vulnerabilities in other products, including Endpoint Manager Mobile and Sentry.