Ivanti patches Connect Secure zero-day after researchers confirm in-the-wild attacks
Ivanti patched Connect Secure zero-day CVE-2026-104935 after UTA0576 used it for remote command execution.
Ivanti released Connect Secure updates for CVE-2026-104935, an 8.6-rated authentication bypass that lets unauthenticated remote attackers run arbitrary commands. Ivanti said a limited number of customers were exploited before backports were finished; Volexity tracks the previously unknown criminal actor as UTA0576. Observed activity included credential theft, data exfiltration, log tampering, and network reconnaissance using built-in appliance commands, without malware or web shells. A separate privilege-escalation bug is not covered by this CVE, and Ivanti expects a fix in the coming weeks.
84