Ivanti warns of Connect Secure zero-day CVE-2026-104935 exploited in attacks

Ivanti has warned of a zero-day vulnerability in its Connect Secure product, CVE-2026-104935, that allows unauthenticated command execution and is being actively exploited in attacks. The company reported limited exploitation and recommends updating Xtraction and rotating affected credentials and secrets.

Detected & updated continuously · Source: Nebula