Ivanti warns of Connect Secure zero-day exploited in attacks
Remote threat actors without privileges can exploit CVE-2026-104935 in low-complexity attacks that don't require user interaction to execute arbitrary commands on targeted ICS appliances.
"At the time of disclosure, Ivanti is aware of limited exploitation in the wild. We are working directly with those organizations while making information, updates and remediation available to the broader customer community. If you are running one of the impacted versions, Ivanti recommends you act immediately," Ivanti said.
"Customers should review the security advisory, upgrade to the fixed version as soon as possible, and run the Integrity Checker Tool regularly."
Internet threat watchdog Shadowserver now tracks over 5,500 ICS instances exposed online, but there is no information on how many are honeypots or have already been secured against ongoing attacks.
Related Articles
