A serious flaw in Ivanti Connect Secure, a popular remote access VPN, is being used by attackers to take over devices without needing a password. Part of the problem is still unpatched.

• What it is: an authentication bypass (CVE-2026-104935) that lets an attacker run commands on the VPN appliance. Security researchers report it has been chained with other flaws since early October to gain full control, even on devices that were already patched.
• Who is affected: organisations running Ivanti Connect Secure version 22.8R2.4 or earlier, 25.1.2.2 or earlier, or 25.1.1.1 or earlier. Thousands of these devices are exposed to the internet.
• The risk: attackers can reach your internal network, steal data and cover their tracks by altering logs, which makes a break-in harder to spot.
• What to do: Ivanti has fixed two of the three flaws used in the attack. Upgrade to the latest fixed version straight away and run Ivanti's Integrity Checker Tool regularly.

If your business uses Ivanti Connect Secure, we recommend contacting us today so we can check your version and look for signs of compromise. Source: BleepingComputer.