Attackers Exploit Ivanti Connect Secure Zero-Day Before Fix Reached All Supported Versions
Summary
Attackers exploited CVE-2026-104935 in Ivanti Connect Secure appliances. Ivanti had patched part of the flaw in one release but was still backporting fixes; CISA added it to KEV, and researchers warned its integrity tool may miss exploitation.
Key points
- Ivanti reported in-the-wild exploitation of CVE-2026-104935, involving an authentication bypass and unauthenticated remote code execution in Connect Secure appliances.
- Volexity attributed the exploit chain to UTA0576 and said it also used an undisclosed privilege-escalation flaw to gain root-level execution.
- Ivanti said it discovered part of the vulnerability in July and fixed it in version 25.1.3.0, but had not completed backports to all supported versions when exploitation occurred.
- Volexity said attackers extracted credentials, accessed the victim organization's Active Directory, and deleted evidence from Ivanti debug logs; the attackers' ultimate objective was unclear.
- CISA added CVE-2026-104935 to its Known Exploited Vulnerabilities catalog and set an Oct. 16 mitigation deadline for federal civilian agencies.
- Volexity recommended monitoring for mismatches between URL paths and the X-DSCGI-PATH header, and warned that Ivanti's Integrity Checker Tool may miss in-memory modifications; network and memory forensics may be needed.
Article Details
- Vulnerability Types
- Authentication bypass
- Unauthenticated remote code execution
- Privilege escalation
- Severity
- High; CVSS 8.6
- Exploitation Status
- active
- Exploit Availability
- unknown
- Patch Status
- partial
- Workarounds
- Disable the appliances.
MITRE ATT&CK
CVE
People
Threat Actors
Vendors
Products
Ivanti Connect SecureIvanti found itself in this week, as attackers exploited two zero-day vulnerabilities in Ivanti Connect Secure (ICS) products: a high-severity authentication bypass vulnerability and the follow-on ability forMicrosoft Active Directoryand then engaged in a variety of post-compromise activities, from accessing the organization's Active Directory to deleting exploitation evidence from Ivanti debug logs. Volexity researchers said because the