CVE-2026-104935 is a high-severity authentication bypass zero-day that allows remote attackers to execute arbitrary commands on Ivanti Connect Secure appliances without user interaction.
CVE-2026-104935: scope and mechanics
The vulnerability, tracked as CVE-2026-104935 and reported by cybersecurity firm Volexity, affects Ivanti Connect Secure (ICS) versions 22.8R2.4 and earlier, 25.1.2.2 and earlier, and 25.1.1.1 and earlier. Ivanti described the bug as a high-severity authentication bypass zero-day exploitable by remote threat actors “without privileges” in low-complexity attacks that do not require user interaction and that can “execute arbitrary commands on targeted ICS appliances.”
Ivanti advisory: patch, upgrade, and run the Integrity Checker Tool
On Tuesday Ivanti urged customers to act immediately, saying, “At the time of disclosure, Ivanti is aware of limited exploitation in the wild. We are working directly with those organizations while making information, updates and remediation available to the broader customer community. If you are running one of the impacted versions, Ivanti recommends you act immediately.”
Ivanti’s guidance is concise and prescriptive: “Customers should review the security advisory, upgrade to the fixed version as soon as possible, and run the Integrity Checker Tool regularly.” The company, which the source notes has over 3,000 employees, a network of over 7,000 partners, and more than 40,000 customers worldwide using its IT asset management solutions, is working directly with affected organizations while publishing updates to the wider customer base.
This site is the portfolio.
OSINTSights runs on Cloudflare Workers, D1, R2, and Vectorize, with an AI pipeline on Hetzner ARM. Nubivance designed, built, and operates it. We do the same for clients.
See what we buildExposure on the internet: Shadowserver’s count
Internet threat monitor Shadowserver is now tracking over 5,500 Ivanti Connect Secure instances exposed online. The data point is stark, but the public record accompanying the count does not say how many of those systems are honeypots or have already been secured against ongoing attacks. That unresolved detail matters because a single exploited appliance can serve as a foothold into broader enterprise networks.
Ivanti’s recent vulnerability history and CISA’s flags
The current zero-day arrives against a pattern of frequent, serious flaws in Connect Secure appliances that have been exploited in the wild. Ivanti previously patched an authentication bypass (CVE-2023-46805) and a command injection (CVE-2024-21887) in early January 2024, followed two weeks later by a server-side request forgery (CVE-2024-21893). In January 2025 Ivanti fixed a remote code execution vulnerability tracked as CVE-2025-0282, and it later fixed a second RCE (CVE-2025-22457) that the source says “China-linked cyber spies have exploited since at least mid-March 2025.”
The Cybersecurity and Infrastructure Security Agency (CISA) has flagged 36 vulnerabilities across various Ivanti products as actively exploited in the wild since November 2021; 12 of those flaws have also been abused by ransomware gangs, according to the same record. That tally underlines why both defenders and overseers track Ivanti product security closely.
What this means for technologists, enterprises, and regulators
- Technologists and security teams: Confirm the exact ICS build in use, prioritize upgrades to the fixed versions Ivanti has released, and run the Integrity Checker Tool as Ivanti recommends to detect compromise indicators. The vulnerability’s description — low complexity, no user interaction, remote arbitrary-command execution — makes patching a high-priority operational task.
- Affected enterprises and procurement leaders: Inventory exposed ICS appliances and determine whether any of the over 5,500 internet-facing instances are in your estate. Where upgrades cannot be applied immediately, isolate or take appliances offline until mitigations are in place, and coordinate with Ivanti if contacted as part of the company’s direct remediation support.
- Policymakers and regulators (including CISA): The agency’s record of flagging 36 Ivanti product vulnerabilities since November 2021 — a dozen intersecting with ransomware abuse — reinforces ongoing monitoring and notification priorities for entities dependent on remote access gateways.
Ivanti’s message is unmistakable: limited exploitation has been observed, and customers running impacted versions are urged to upgrade and validate with the vendor’s tools. The combination of a remotely exploitable authentication bypass, thousands of internet-exposed appliances, and a recent history of chained and widely abused Ivanti flaws leaves one concrete question: how many of the 5,500+ exposed instances are already patched, hardened, or intentionally isolated — and how many remain vulnerable to an exploit that requires no user action?
