Ivanti Connect Secure Zero-Day Was Exploited for 12 Days Before a Patch

Attackers had a 12-day head start. According to threat-intelligence firm Defused, someone began exploiting a previously unknown flaw in Ivanti Connect Secure on Oct. 1, 2026. Ivanti didn't warn customers or ship a fix until Tuesday, Oct. 13.

Now Ivanti is telling every organization that runs the remote-access VPN gateway to patch immediately. The Ivanti Connect Secure zero-day, tracked as CVE-2026-104935, is a high-severity authentication bypass that lets an attacker with no credentials run commands on the device, BleepingComputer reported. The Cybersecurity and Infrastructure Security Agency added it to its Known Exploited Vulnerabilities catalog the same day.

The patch doesn't close the whole hole. Ivanti has fixed two flaws in the attack chain, but a third, a privilege-escalation bug, remains unpatched. And Ivanti isn't the only security vendor in CISA's sights this week: on Oct. 14, the agency flagged actively exploited flaws in Palo Alto Networks PAN-OS firewalls and Cisco Secure Email Gateway.

What the Ivanti Connect Secure zero-day lets attackers do

Connect Secure, formerly Pulse Connect Secure and before that Juniper Pulse, is the gateway many US companies, state and local governments, schools, hospitals and federal agencies use to let employees reach internal systems from outside the office. It sits on the public internet by design.

CVE-2026-104935 lets an attacker skip the login entirely. CISA's catalog lists it as an "Ivanti Connect Secure Authentication Bypass by Spoofing Vulnerability." According to BleepingComputer's account of Ivanti's advisory, exploitation requires no authentication, no user interaction and little complexity, and a successful attacker can execute arbitrary commands on the targeted appliance.

That combination is the worst case for a perimeter device. There's no phishing email to block and no password to steal. Anyone who can reach the gateway over the network can attempt the exploit.

"At the time of disclosure, Ivanti is aware of limited exploitation in the wild," the company said in its advisory, as quoted by BleepingComputer. Ivanti has not said publicly how many customers were hit. "Limited" is a description that tends to age badly once exploit details start circulating among other criminal groups.

Which Ivanti Connect Secure versions are affected

Per BleepingComputer's report, the vulnerability affects:

• Ivanti Connect Secure 22.8R2.4 and earlier
• Ivanti Connect Secure 25.1.2.2 and earlier
• Ivanti Connect Secure 25.1.1.1 and earlier

Ivanti released the fix alongside its Oct. 13 advisory. Because the company maintains more than one release line, administrators should confirm the exact fixed build for their branch in Ivanti's advisory before upgrading, rather than assuming the newest version number they see is the right one.

Attacks started Oct. 1, and one flaw in the chain is still unpatched

Security firm Volexity discovered the attacks and reported them to Ivanti. Volexity tracks the group behind them as UTA0576. Neither Ivanti nor the public reporting so far has said who that group is, whether it works on behalf of a government or which organizations it targeted.

What is known is that UTA0576 chained three vulnerabilities together. Ivanti has patched two of them, including CVE-2026-104935. Details on the second patched flaw were thin in the initial reporting. The third, a privilege-escalation bug, is still being worked on, and Ivanti has not published a date for that fix.

Defused confirmed Volexity's findings and said it first observed CVE-2026-104935 being exploited on Oct. 1. That gap matters more than the patch date. Any organization running a vulnerable gateway during those 12 days could have been compromised before a fix existed, and installing the update does nothing to evict an attacker who already got in, planted a backdoor or harvested credentials.

The unpatched privilege-escalation bug adds another layer of uncertainty. With the authentication bypass closed, an attacker would in principle need a different foothold to use it. But until Ivanti ships the third fix, the chain is only partly broken, and organizations that were breached before Oct. 13 may still have an intruder positioned to take advantage of it.

Palo Alto PAN-OS, Cisco and Ahsay flaws join CISA's exploited list

The Ivanti bug was one of six actively exploited flaws CISA added to its catalog over two days. Most of them sit in the kind of equipment organizations place at the edge of their networks to keep attackers out.

We covered the Windows bug separately in Microsoft Patches Exploited Windows Flaw as CISA Deadline Nears. The Oct. 14 additions came in a second CISA alert.

The PAN-OS flaw is the one most firewall administrators will want to look at first. Cyber Security News reported on Oct. 15 that hackers are using the high-severity bug to let authenticated attackers execute code as root on Palo Alto firewalls. Requiring a login makes it harder to exploit than the Ivanti flaw, but root access on a firewall gives an intruder control of the device meant to police traffic. The same outlet reported that the Cisco Secure Email Gateway zero-day is being actively exploited; public technical detail on that flaw beyond CISA's listing remains sparse.

CISA's Binding Operational Directive 26-04 requires only federal civilian executive branch agencies to remediate KEV-listed flaws by the deadlines CISA sets. The agency said it "strongly urges" everyone else to prioritize them too, a recommendation that private companies, hospitals and local governments ignore at their own risk.

Why Ivanti VPN gateways keep getting hit

This is familiar territory for Ivanti. According to BleepingComputer, CISA has flagged 36 actively exploited vulnerabilities across Ivanti products since November 2021, and ransomware gangs have used 12 of them.

The reasons go beyond any one vendor. VPN and remote-access gateways are reachable from anywhere, they hold the keys to internal networks, and they often handle authentication for thousands of users. A single working exploit can open doors at many organizations at once. That makes these devices a favorite target for state-backed espionage crews and ransomware operators alike.

This week's pattern, with Ivanti, Palo Alto and Cisco security products all appearing in CISA's catalog within 48 hours, shows how much of the attack pressure now lands on the security gear itself. The products bought to keep intruders out have become the front door they try first.

How to tell if your Ivanti VPN was breached, and what to do now

If your organization runs Ivanti Connect Secure, patching is the first step, not the last. IT and security teams should work through the following:

1. Inventory and patch. Find every Connect Secure appliance, including forgotten test or backup units, and compare its version against the affected list. Install Ivanti's Oct. 13 update now.
2. Assume compromise and hunt. Because exploitation began around Oct. 1, review gateway logs, configuration changes, new or modified accounts and unusual outbound connections going back to at least late September. A clean patch on a compromised box leaves the attacker in place.
3. Rotate credentials if anything looks wrong. Accounts and secrets that passed through a compromised gateway should be treated as exposed.
4. Track the third fix. Watch Ivanti's advisory for the privilege-escalation patch and apply any interim mitigation guidance Ivanti or CISA publishes in the meantime.
5. Patch the rest of this week's list. Update PAN-OS for CVE-2026-0322, Cisco Secure Email Gateway for CVE-2026-76519 and AhsayCBS for CVE-2026-105133 and CVE-2026-105134.

Consumers don't need to do anything with their own devices. But a breached gateway at an employer, hospital or government office can lead to stolen personal data or a ransomware attack weeks later, which is why the patching speed of those organizations matters to everyone.

The next milestones are Ivanti's fix for the remaining privilege-escalation bug, the CISA deadline for federal agencies and any public proof-of-concept exploit, which historically has been the moment targeted attacks turn into mass scanning. Defenders should also watch for Volexity or Ivanti to say more about who UTA0576 is and what it took. Until then, any Connect Secure gateway that was online and unpatched in early October deserves a close look.