Chained exploitation of Ivanti Connect Secure zero-days

Ivanti Connect Secure (ICS) appliances are the target of a reported zero-day exploit chain that, according to researchers, lets attackers run code as root without authentication. Ivanti publicly urged customers on October 13, 2026 to patch the flaw tracked as CVE-2026-104935, which it says has seen limited exploitation in the wild. The situation is evolving and at least one part of the chain is not yet fixed.

What's happening

According to BleepingComputer, Ivanti is warning of an actively exploited authentication-bypass zero-day in its ICS remote-access gateway, tracked as CVE-2026-104935. The company said remote, unauthenticated attackers could exploit it in low-complexity attacks that do not require user interaction to run arbitrary commands on affected appliances.

Security firm Volexity, which says it found and reported the issue, describes a chained attack by a threat actor it tracks as UTA0576 that combined an authentication bypass, a remote code execution flaw, and a privilege escalation vulnerability to achieve unauthenticated root-level code execution. Volexity says the actor exploited the chain against a fully patched ICS appliance (22.8R2.4, Build 19097) and has been doing so repeatedly since at least October 3, 2026. A second firm, Defused, is said to have confirmed exploitation starting October 1. Ivanti patched the authentication-bypass and RCE parts on October 13, 2026, but says it is still working on the privilege-escalation flaw, with a fix expected in a future release in the coming weeks.

Notably, Volexity reports that the attacker deployed no malware or web shell, re-exploiting the device for each command and tampering with debug and audit logs. Because the exploit only patches code in memory and restores configuration, Ivanti's Integrity Checker Tool reportedly does not flag the modifications on its own.

Who's affected

Ivanti says the authentication-bypass flaw affects ICS versions 22.8R2.4 and earlier, 25.1.2.2 and earlier, and 25.1.1.1 and earlier. These are enterprise SSL VPN gateways used by remote employees, contractors, and hybrid workers to reach corporate and cloud resources, so exposure tends to sit on internet-facing edge appliances.

Internet watchdog Shadowserver reportedly tracks more than 5,500 ICS instances exposed online, though it is unclear how many are honeypots or have already been secured. Ivanti notes it is aware only of limited exploitation in the wild and is working directly with affected organizations. CISA has separately flagged dozens of Ivanti product vulnerabilities as exploited in the past.

What to do

Treat internet-facing ICS appliances as urgent: Ivanti recommends customers act immediately and upgrade to the fixed version as soon as possible.
Review the official Ivanti advisory for the fixed versions and follow its remediation steps; do not rely on delays.
Run the Integrity Checker Tool regularly as Ivanti advises, but note that Volexity reports this particular chain may evade it, so a clean result is not proof of safety.
If you see signs of compromise, such as attempts to move laterally originating from the ICS appliance, treat the device as potentially breached and begin forensic investigation rather than assuming a patch closes the case.
The privilege-escalation component was, at the time of writing, not yet patched; expect a further vendor update and re-check the advisory.

Sources

BleepingComputer — reports Ivanti's warning about CVE-2026-104935, the affected versions, and the limited exploitation in the wild.
Volexity — the vendor that says it discovered the chain and describes UTA0576's exploitation, post-exploitation activity, and anti-forensics.
The Hacker News — reports on the chained exploitation of the three Ivanti Connect Secure flaws.