Attackers Exploited Ivanti Connect Secure Zero-Days Before a Patch Was Available
Summary
Attackers chained three zero-days in Ivanti Connect Secure to bypass authentication, execute code and escalate privileges. Ivanti has patched part of the chain; compromise is under investigation, and customers are urged to update and investigate.
Key points
- Volexity linked in-the-wild exploitation to threat actor UTA0576, with the earliest confirmed activity on Oct. 1.
- The exploit chain enabled authentication bypass, remote code execution and privilege escalation in Ivanti Connect Secure VPN appliances.
- Attackers stole device-stored credentials and Active Directory metadata, tampered with logs, and conducted network reconnaissance.
- Ivanti disclosed CVE-2026-104935 and patched the unauthenticated remote-code-execution component; it says updates for the remaining vulnerability are in development.
- Ivanti said a limited number of customers were compromised before disclosure; the full scope remains under investigation.
- CISA added the vulnerability to its Known Exploited Vulnerabilities catalog and urged rapid patching. It warned the Integrity Checker Tool may miss evidence because commands execute in memory.
- Ivanti recommends upgrading, regularly running its Integrity Checker Tool, and reviewing Volexity’s indicators; CISA says determining compromise may require network and memory forensics.
Article Details
- Vulnerability Types
- Authentication bypass
- Remote code execution
- Privilege escalation
- Race condition
- Severity
- High
- Exploitation Status
- active
- Exploit Availability
- unknown
- Patch Status
- partial
- Workarounds
- Upgrade to the latest software version.