Ivanti VPN Zero-Day Under Active Attack: Patch Now and Follow Volexity's Guidance

Government agencies and researchers have warned that a new vulnerability in Ivanti's Connect Secure VPN product is being exploited in the wild. The US Cybersecurity and Infrastructure Security Agency (CISA) gave federal civilian agencies until Friday to patch CVE-2026-104935, which has a severity score of 8.6 out of 10. CISA says it allows remote, unauthenticated execution of arbitrary commands, and that attackers are using it for credential theft and data exfiltration. Ivanti has confirmed exploitation and says it is working with a limited number of affected customers.

Security firm Volexity found the issue after it began investigating malicious activity on October 5. That led it to a fully patched Ivanti VPN appliance that had been abused starting two days earlier. Volexity found three zero-day exploits. Ivanti patched two of them on Tuesday and is still working on a fix for the third. Volexity did not find malware that would let attackers act without re-exploiting the appliance. The attackers appeared to focus on credential theft, data exfiltration, log tampering and network reconnaissance. Volexity assesses, with low confidence, that the motivation is criminal rather than espionage. Both CISA and Ivanti urged defenders to follow Volexity's guidance.

This is the sixth Ivanti vulnerability added to CISA's list of exploited bugs in 2026. The article also notes that CISA warned of a new Microsoft vulnerability being exploited, as part of a record-breaking October Patch Tuesday.