Ivanti warns of Connect Secure zero-day exploited in attacks

CVE-2026-104935 is a zero-day authentication bypass vulnerability in Ivanti Connect Secure (ICS) SSL VPN appliances, enabling remote attackers without privileges to execute arbitrary commands with root-level access. The flaw affects ICS versions 22.8R2.4 and earlier, 25.1.2.2 and earlier, and 25.1.1.1 and earlier. Exploitation requires low complexity and no user interaction. A threat actor tracked as UTA0576 has been observed exploiting this vulnerability since at least October 3, 2026, chaining it with other vulnerabilities to maintain persistent root access and evade detection by tampering with logs and re-exploiting the device for commands. Ivanti has patched two related vulnerabilities but is still addressing a privilege escalation flaw used in the attack chain. The ICS appliances are widely used for secure remote access, making this vulnerability critical for enterprise security.

Successful exploitation of CVE-2026-104935 allows unauthenticated remote attackers to bypass authentication and execute arbitrary commands with root privileges on affected Ivanti Connect Secure appliances. This can lead to full compromise of the device, unauthorized access to corporate networks, and potential data breaches. The vulnerability has been actively exploited in the wild since early October 2026, including by a sophisticated threat actor who evades detection by log tampering and repeated exploitation. The widespread use of ICS appliances in enterprise environments increases the risk and potential impact of this vulnerability.

Ivanti has released patches for some related vulnerabilities and recommends customers immediately upgrade to the fixed versions of Ivanti Connect Secure to remediate CVE-2026-104935. Customers should review Ivanti's official security advisory for detailed patching instructions and run the Integrity Checker Tool regularly to detect tampering. Ivanti is still working on a fix for a related privilege escalation vulnerability used in the attack chain, so monitoring vendor updates is critical. Immediate patching of affected versions is strongly advised to prevent exploitation.