errors.x7.al › Recent issues

Ivanti Connect Secure zero-days are being chained in active attacks

Ivanti has urged customers to immediately patch a vulnerability in its Connect Secure (ICS) remote-access appliances that is being exploited in the wild. Researchers say attackers have been chaining three previously unknown flaws to gain root-level access — reportedly even on a "fully patched" appliance.

What's happening

According to BleepingComputer, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) told security teams to patch an Ivanti Connect Secure flaw "exploited in zero-day attacks since at least October 1st". The issue is tracked as CVE-2026-104935: a high-severity authentication-bypass bug that reportedly lets an unauthenticated remote attacker run arbitrary commands on a targeted ICS system in low-complexity attacks that require no user interaction.

Ivanti released Connect Secure versions 22.8R2.5, 25.1.3.0, 25.1.3.1 and 25.1.1.2 on Tuesday to address the flaw, and warned customers to "act immediately" because of "limited exploitation in the wild".

The security firm Volexity says it found the activity while investigating an incident at one of its customers. It tracks the threat actor as UTA0576 and says the actor began exploiting the flaws on October 3, 2026. According to Volexity, the chain combined an authentication bypass, a remote code execution (RCE) flaw and a privilege-escalation flaw to achieve unauthenticated root-level code execution. It says the first two are tracked under CVE-2026-104935. Notably, Volexity says the appliance it investigated was fully patched at the time (version 22.8R2.4).

Volexity reports post-exploitation behaviour focused on credential theft and reconnaissance, including stealing domain credentials stored on the appliance, dumping limited Active Directory metadata, deploying a custom tool to search Active Directory for LAPS passwords and BitLocker recovery keys, password spraying, and inspecting authentication logs. It says it found no backdoor or web shell on the compromised device.

SecurityWeek notes that the third flaw in the chain — the privilege-escalation issue — reportedly remains unpatched, with the vendor planning to fix it over the coming weeks. It also reports that Volexity assessed with "low confidence" that the actor has criminal rather than espionage motivations.

Who's affected

• Organisations running Ivanti Connect Secure VPN appliances that are internet-exposed, especially those not yet on the patched versions listed above.
• Admins who believe they are already safe. Because the reported chain was used against a fully patched appliance, patching alone may not close every door until all three flaws are fixed.
• Federal agencies in the U.S., after CISA added the CVE to its list of known exploited vulnerabilities and set a deadline for federal civilian agencies.
• The broader internet: internet-threat tracker Shadowserver reports over 5,600 exposed hosts with ICS fingerprints, though it is unclear how many are patched or are honeypots.

What to do

• Update now. Move ICS deployments to one of the fixed versions (22.8R2.5, 25.1.3.0, 25.1.3.1, 25.1.1.2) without waiting.
• Look for signs of compromise. CISA says detection requires network and in-memory forensics, and warns that Ivanti's Integrity Checker Tool may not detect exploitation because attacker commands run in memory.
• If you find evidence of compromise, CISA's advisory lists: back up the appliance configuration; factory reset and upgrade (or rebuild the virtual instance); restore the configuration from the backup; then reset passwords for all accounts (domain, administrator and local) and revoke and reissue stored certificates and API keys.
• Treat this as evolving. Since one flaw in the reported chain may still be unpatched, keep watching Ivanti and CISA advisories.

Sources

• BleepingComputer — reports CISA's warning, the affected CVE, the patched ICS versions and CISA's remediation steps.
• Volexity — the incident-response vendor's technical write-up of the three-flaw chain and the UTA0576 activity.
• SecurityWeek — adds that the third flaw in the chain remains unpatched and covers the attacker's motives assessment.