Remote-access gateways are still one of the fastest ways into an enterprise network. When attackers get code execution on the edge, they are already standing at the door that employees, contractors, administrators, and third parties use every day.

BleepingComputer reported that Ivanti is urging customers to patch an actively exploited Ivanti Connect Secure zero-day. The vulnerability is tracked as CVE-2026-104935 and affects Ivanti Connect Secure versions 22.8R2.4 and earlier, 25.1.2.2 and earlier, and 25.1.1.1 and earlier, according to Ivanti’s advisory.

Ivanti says it is aware of limited exploitation in the wild and recommends affected customers upgrade to a fixed version and run the Integrity Checker Tool regularly.

What happened

CVE-2026-104935 is described as a high-severity authentication-bypass issue in Ivanti Connect Secure. BleepingComputer reports that remote, unauthenticated attackers can exploit it in low-complexity attacks without user interaction to execute arbitrary commands on targeted appliances.

That combination matters: internet-facing VPN or secure-access appliances already sit in the attacker’s preferred part of the network, and command execution on the appliance can become a staging point for credential theft, webshell deployment, configuration theft, and lateral movement.

Shadowserver is tracking more than 5,500 Pulse Secure / Ivanti Connect Secure instances exposed online. Not every exposed system is vulnerable or production, but the number is large enough that defenders should assume exploitation attempts will scale quickly.

Why this matters for SMBs and government contractors

Small and mid-sized organizations often treat VPN appliances as “set it and forget it” infrastructure. Government contractors cannot afford that model. These devices broker remote access, sit near sensitive networks, and often contain authentication integrations, certificates, logs, session data, and network reachability that attackers can abuse.

For contractors handling CUI, customer data, proposal material, or managed IT environments, a compromised edge gateway can become a reporting, containment, and trust problem — not just a patch ticket.

Ivanti devices have also been repeatedly targeted in prior campaigns. The practical takeaway is that edge devices need a dedicated patch-and-hunt workflow, not routine monthly maintenance.

Defensive priorities

1. Identify every Ivanti Connect Secure instance

Inventory public and private deployments, including lab appliances, legacy Pulse Secure systems, disaster-recovery instances, and third-party managed gateways. Confirm version, exposure, business owner, authentication configuration, and logging coverage.

2. Patch immediately

Upgrade affected systems to Ivanti’s fixed releases. If a gateway cannot be patched quickly, restrict access aggressively while a replacement or emergency maintenance path is arranged. Internet exposure should be treated as a temporary exception, not the default.

3. Run integrity checks and preserve evidence

Run Ivanti’s Integrity Checker Tool and preserve the results. If there are anomalies, collect appliance logs, authentication events, VPN session records, network flows, configuration exports, and EDR/SIEM timelines before rebuilding or replacing the device.

4. Hunt beyond the appliance

A clean patch does not prove the network is clean. Look for suspicious VPN sessions, new administrative accounts, changed authentication settings, unusual source geographies, anomalous service-account use, outbound connections from the appliance, and internal access that followed suspicious gateway activity.

5. Rotate secrets when compromise is suspected

If exploitation is confirmed or strongly suspected, rotate credentials and secrets that may have crossed the gateway: local admin credentials, LDAP bind accounts, SAML/OIDC secrets, certificates, service accounts, and any credentials used during remote administrative sessions.

Detection ideas

  • Unusual child processes, file writes, or shell activity on the gateway.
  • Integrity Checker Tool warnings or unexpected appliance file changes.
  • VPN sessions from new countries, hosting providers, or impossible-travel patterns.
  • Authentication attempts that bypass normal MFA or conditional-access expectations.
  • Configuration exports, certificate access, or administrator changes near suspicious session times.
  • Internal reconnaissance from VPN address pools shortly after edge-device anomalies.

Bulwark Black assessment

This is another reminder that perimeter appliances are not just networking equipment. They are privileged access systems. If a device terminates remote access, holds identity integrations, and bridges the internet to internal resources, it belongs in the same risk tier as identity providers, RMM tools, hypervisors, and CI/CD controllers.

The right response is direct: patch the vulnerable Ivanti Connect Secure systems, run integrity checks, hunt for post-exploitation activity, and reduce exposure wherever possible. For SMBs and government contractors, the difference between “patched” and “secure” is the compromise review that happens after the patch.

Sources: BleepingComputer; Ivanti October 2026 security update; Ivanti advisory for CVE-2026-104935.