Ivanti disclosed on 13 October that a previously unknown flaw in its Connect Secure VPN gateway, tracked as CVE-2026-104935, is being actively exploited. The bug is an authentication bypass: a remote attacker with no account and no user interaction can run arbitrary commands directly on the appliance. Security firm Volexity identified the exploitation and worked with Ivanti to get protections to affected customers; Ivanti's own advisory confirms a limited number of customers were compromised before fixes shipped. Patched builds are available now — 22.8R2.5, 25.1.1.2, 25.1.3.0 and 25.1.3.1, depending on which release track an organisation runs — and CISA has added the flaw to its Known Exploited Vulnerabilities catalogue with a short remediation deadline.
Connect Secure is a VPN gateway used by more than 40,000 organisations worldwide as the entry point for remote staff logging into internal networks, and researchers tracking internet-facing devices count more than 5,500 appliances still reachable from the open internet. That combination — a device designed to sit exposed to the internet, with a flaw that needs no credentials to exploit — is exactly why edge VPN and remote-access appliances keep turning up in attacks: they're high value and, unlike a desktop or laptop, often go unpatched for long stretches because nobody wants to touch a production gateway. Ivanti has shipped several Connect Secure fixes for similarly exploited zero-days over the past few years, and the pattern each time is the same: quiet exploitation in the wild, then a scramble to patch once it's caught.
What this means for your business
If your business, or whoever manages your network, runs Ivanti Connect Secure, this is worth acting on this week rather than at the next routine maintenance window: confirm your version against Ivanti's advisory, apply the fixed build for your track, and run Ivanti's Integrity Checker Tool, patching alone doesn't remove an attacker who already got in beforehand.
Even if you don't run Ivanti specifically, the underlying lesson applies to any remote-access gateway, VPN appliance, or firewall your business depends on. These devices sit directly on the internet by design, which makes them a favourite target, and they're also the easiest piece of infrastructure to quietly neglect because updating one risks disrupting everyone's remote access. Ask whoever manages yours, in-house staff or an external IT provider, two concrete questions: which vendor security advisories do you actually monitor, and how quickly do patches for internet-facing devices get applied once they're released. If you can't get a confident answer, that gap is worth closing before an attacker finds it for you.