A Vulnerability in Ivanti Connect Secure Could Allow for Arbitrary Code Execution

A vulnerability has been discovered in Ivanti Connect Secure (ICS) that could allow for arbitrary code execution. Ivanti Connect Secure is an enterprise-grade SSL VPN and zero-trust remote access gateway. Successful exploitation of this vulnerability could allow a remote unauthenticated attacker to execute arbitrary commands.

Ivanti reports that CVE-2026-104935 has been exploited in the wild.

A vulnerability has been discovered in Ivanti Connect Secure (ICS) that could allow for arbitrary code execution. Details of this vulnerability are as follows:

Tactic:Initial Access(TA0001):

Technique:Exploit Public-Facing Application(T1190):

Successful exploitation of this vulnerability could allow for arbitrary code execution in the context of the system. Depending on the privileges associated with the system, an attacker could then install programs; view, change, or delete data.

We recommend the following actions be taken:

Copyright©2026 Center for Internet Security®