Warning: Actively Exploited Zero-Day Vulnerability in Ivanti Connect Secure Allows Remote Code Execution, Patch Immediately!

Ivanti Connect Secure appliances are affected by CVE-2026-104935, an authentication-bypass vulnerability that Volexity observed chained with a file-write RCE and a separate privilege-escalation to achieve unauthenticated root code execution. Attackers exploited impacted appliances in the wild to steal LDAP credentials, retrieve LAPS and BitLocker recovery data, intercept LDAP traffic, conduct password-spraying and reconnaissance, and alter logs to hide activity; patches and detection/forensic guidance are provided and remediation is urgent.