Ivanti warns of Connect Secure zero-day exploited in attacks

Ivanti has urged customers to immediately patch an actively exploited zero-day in the Ivanti Connect Secure remote access gateway, BleepingComputer reports. CVE-2026-104935 is a high-severity authentication bypass affecting ICS versions 22.8R2.4 and earlier that lets unauthenticated attackers execute arbitrary commands on targeted appliances.