Ivanti has urged customers to patch an Ivanti Connect Secure zero-day that attackers are actively exploiting. Tracked as CVE-2026-104935, the authentication bypass vulnerability allows unauthenticated attackers to execute arbitrary commands on affected appliances.
The company reported limited exploitation when it disclosed the issue on October 13. Meanwhile, researchers linked the vulnerability to an attack chain that provided root-level access without deploying malware.
Authentication Bypass Affects Multiple Versions
Ivanti Connect Secure is an enterprise SSL VPN gateway that gives remote workers and contractors access to corporate and cloud resources.
The high-severity vulnerability affects the following releases:
- ICS 22.8R2.4 and earlier.
- ICS 25.1.2.2 and earlier.
- ICS 25.1.1.1 and earlier.
Attackers need no existing privileges or user interaction to exploit the flaw. Moreover, Ivanti describes the attacks as low complexity.
The company advised affected customers to install the fixed release immediately and run its Integrity Checker Tool regularly. However, researchers found that the observed attackers could evade that tool.
Attackers Combined Three Flaws to Gain Root Access
Volexity discovered and reported the Ivanti Connect Secure zero-day while investigating activity attributed to a previously unknown group, UTA0576.
According to its findings, the group chained CVE-2026-104935 with two other vulnerabilities to achieve unauthenticated root-level code execution. The attacks succeeded against devices that were fully patched at the time.
Volexity traced the activity to at least October 3. Separately, threat intelligence company Defused reported observing exploitation as early as October 1.
At disclosure, Ivanti had patched two vulnerabilities involved in the chain. However, it was still developing a fix for the privilege escalation flaw that attackers also used.
Repeated Exploitation Helped Attackers Avoid Detection
Rather than installing malware or a web shell, UTA0576 exploited the appliance again for every command it executed.
The group also altered logs to conceal its activity. According to Volexity, this approach evaded Ivanti’s Integrity Checker Tool.
These findings highlight a limitation of relying on integrity checks alone. Although Ivanti recommends running the tool regularly, the observed attack method could leave a compromised appliance without the malware artifacts such checks might detect.
Thousands of Connect Secure Devices Remain Online
Shadowserver tracked more than 5,500 internet-exposed Connect Secure instances around the time of disclosure.
However, that figure does not establish how many devices remained vulnerable. The available data did not distinguish patched systems from unpatched appliances or identify how many instances were honeypots.
Ivanti said it was working directly with affected organizations while providing updates and remediation information to other customers.
Connect Secure Faces Repeated Exploitation
The latest attacks follow several earlier incidents involving Connect Secure vulnerabilities.
In January 2024, Ivanti addressed an authentication bypass, CVE-2023-46805, and a command injection flaw, CVE-2024-21887. Later that month, it also patched the server-side request forgery vulnerability CVE-2024-21893.
Further incidents followed in 2025. Ivanti fixed CVE-2025-0282 in January and subsequently addressed CVE-2025-22457, which China-linked espionage actors had exploited since at least mid-March.
At the time of the latest disclosure, CISA had catalogued 36 actively exploited vulnerabilities across Ivanti products since November 2021. It also associated 12 of those vulnerabilities with ransomware campaigns.
For affected Connect Secure customers, Ivanti’s immediate recommendation is to review the advisory and upgrade promptly. Administrators should also account for the reported detection limitations and the outstanding privilege escalation fix.
0 responses to “Ivanti Connect Secure Zero-Day Exploited in Ongoing Attacks”