TL;DR Ivanti updated an urgent security update on October 29, 2026, addressing a critical Ivanti Connect Secure vulnerability chain. This flaw is actively exploited in the wild against enterprise gateways. Attackers combine an authentication bypass with local privilege escalation to take over virtual private network appliances. System administrators must apply the latest patches immediately and scan their systems with the vendor integrity tool.

TL;DR Ivanti updated an urgent security update on October 29, 2026, addressing a critical Ivanti Connect Secure vulnerability chain. This flaw is actively exploited in the wild against enterprise gateways. Attackers combine an authentication bypass with local privilege escalation to take over virtual private network appliances. System administrators must apply the latest patches immediately and scan their systems with the vendor integrity tool.

At a glance Actor UTA0576, an unknown threat actor tracked by Volexity Activity Zero-day exploitation of an Ivanti Connect Secure VPN, then credential theft and data exfiltration Targets One Volexity monitoring customer running a fully patched appliance Scale One confirmed victim; no financial losses disclosed Status No law-enforcement action reported; Ivanti patched CVE-2026-104935 on October 13, 2026 Source

TL;DR Ivanti disclosed CVE-2026-104935 on October 13, 2026, and confirmed the flaw is already exploited in the wild. The Ivanti Connect Secure vulnerability lets a remote, unauthenticated attacker run arbitrary commands. Fixed versions are available now. Why It Matters Connect Secure is a VPN gateway that sits at the network edge. A breach can therefore give attackers a foothold inside corporate networks.