Ivanti has alerted users to a high-severity vulnerability in its Connect Secure product. The vulnerability, identified as CVE-2026-104935, is an authentication bypass flaw that enables remote threat actors to execute arbitrary commands on affected systems without user interaction.

The vulnerability impacts Ivanti Connect Secure versions 22.8R2.4 and earlier, 25.1.2.2 and earlier, and 25.1.1.1 and earlier. Ivanti Connect Secure is used for secure remote access to corporate and cloud resources.

Ivanti has confirmed limited exploitation of CVE-2026-104935 in the wild. The exploitation was initially discovered by Volexity on October 3, 2026. The attacker, tracked as UTA0576, has reportedly chained this vulnerability with two other flaws to gain root access.

Ivanti has released patches for two of the vulnerabilities but is still developing a fix for a third, which is a privilege escalation vulnerability. CVE-2026-104935 is also listed in the U.S. Cybersecurity and Infrastructure Security Agency's Known Exploited Vulnerabilities catalog.

Ivanti has a history of its products being exploited in the wild, often as zero-day vulnerabilities.