errors.x7.al › Recent issues

Ivanti warns of a Connect Secure zero-day reportedly exploited in attacks

Ivanti is urging customers to immediately patch an actively exploited zero-day in its Connect Secure (ICS) remote-access gateway. The flaw, tracked as CVE-2026-104935, was disclosed on 13 October 2026, and the security firm Volexity says an attacker chained it with two other issues to run commands as root on a fully patched appliance.

What's happening

According to BleepingComputer, CVE-2026-104935 is a high-severity authentication bypass in Ivanti Connect Secure. It can reportedly be exploited by unprivileged remote attackers in low-complexity attacks that need no user interaction, allowing them to run arbitrary commands on affected appliances.

Volexity, which reported the flaws to Ivanti, says it found an intrusion on a customer appliance that was fully patched at the time and running version 22.8R2.4. The attacker — tracked as UTA0576 — began exploiting it on 3 October. Per Volexity, three zero-days were chained: an authentication bypass and a remote code execution flaw (tracked together as CVE-2026-104935), which let code run as the appliance's cgi-server user, plus a third privilege-escalation flaw that raised access to root.

Ivanti has released fixes for two of the three flaws, but a fix for the privilege-escalation piece is still pending, according to Volexity. Ivanti said on 13 October that it is aware of "limited exploitation in the wild" and is working directly with the affected organizations.

Volexity also says the attacker deployed no malware or web shell; instead it reportedly re-exploited the device for each command it ran and tampered with logs to cover its tracks, evading Ivanti's Integrity Checker Tool. The threat-intelligence firm Defused said it confirmed Volexity's report and saw the first signs of exploitation starting 1 October. This is an evolving situation.

Who's affected

• Organizations running Ivanti Connect Secure on affected versions: 22.8R2.4 and earlier, 25.1.2.2 and earlier, and 25.1.1.1 and earlier, per BleepingComputer.
• Internet-exposed appliances are the main concern. ICS is an SSL VPN used to give remote employees and contractors access to corporate and cloud resources. The internet watchdog Shadowserver currently tracks more than 5,500 ICS instances exposed online, though it is not known how many are honeypots or have already been secured.
• Enterprises generally. Ivanti VPN appliances have repeatedly been targeted as zero-days because they can offer a quick route into enterprise networks; CISA has flagged dozens of Ivanti flaws as exploited in the wild since 2021.

What to do

• Upgrade to the fixed version as soon as possible. Ivanti recommends reviewing the security advisory, upgrading, and running the Integrity Checker Tool regularly.
• Note that not every flaw in the chain is patched yet. Volexity says the privilege-escalation flaw was still unaddressed at the time of reporting; keep watching Ivanti's advisories for a fix.
• Treat internet-facing appliances as high priority, and consider whether any can be taken offline or restricted until they are fully patched. No bypass workaround has been published by the vendor beyond upgrading.
• Hunt for signs of compromise. Because the reported attacker tampered with logs to evade the Integrity Checker Tool, routine log checks alone may not be enough; broader forensic review is generally advised.

Sources

• BleepingComputer — reports the flaw and affected versions, Ivanti's statement, Volexity's three-flaw chain, and Shadowserver's count of exposed appliances.
• The Hacker News — reports that three zero-days were chained, that only two are patched so far, and the UTA0576 attribution and exploitation window.
• Volexity — the firm's disclosure of the chained exploitation observed on a fully patched appliance.