Ivanti patches Connect Secure zero-day after researchers confirm in-the-wild attacks

Vendor promises fix for separate privilege-escalation flaw in the coming weeks

Ivanti customers are being urged to update Connect Secure and check for compromise after attackers exploited a newly disclosed zero-day vulnerability.

On Tuesday, Ivanti released updates for Connect Secure (ICS) to fix CVE-2026-104935, an authentication bypass flaw discovered by Volexity. Rated 8.6 on the CVSS scale, it allows remote, unauthenticated attackers to execute arbitrary commands.

"We are aware of exploitation in the wild affecting a limited number of customers at the time of disclosure," the vendor said in its advisory.

There are limited indicators of compromise available at present, it said, advising customers to refer to Volexity's report on the findings for more information, and to run the Ivanti Integrity Checker Tool regularly.

Ivanti lists affected releases in the following branches:

• 25.1.1.1 and earlier

• 25.1.2.2 and earlier

• 22.8R2.4 and earlier

The vendor said it previously identified "a portion of this vulnerability" and patched it in July's 25.1.3.0 update, and had been working on backporting the same fix since then, however, attackers began exploiting it before that work was complete.

Volexity said the attackers behind the recent intrusions were previously unknown to its researchers, but are now tracked as UTA0576.

Criminal motive rather than espionage is suspected by Volexity. Based on observed post-exploitation activity, attackers appeared to be most interested in using their newfound access for credential theft, data exfiltration, log tampering, and network reconnaissance.

Notably, the attackers did not deploy any malware nor execute web shells, using only the commands available to them on the ICS appliance.

"Because the operation was detected and disrupted, the threat actor's ultimate objectives could not be determined," said Volexity.

"However, Volexity assesses with high confidence that UTA0576's actions signaled preparation for lateral movement and a broader compromise of the victim network."

The researchers also suspect that the attackers were using large language models to support their endeavors.

Volexity pointed to the attackers' repeated use of the exploit channel to run commands, rather than deploying web shells, and their use of "highly specific scripts using hardcoded credentials."

Ivanti disclosed one CVE, but Volexity described an attack chain involving three vulnerabilities. Tuesday's updates address the authentication bypass and remote code execution stages.

The third vulnerability, which allows privilege escalation, is separate from the flaws encompassed by CVE-2026-104935.

Volexity said Ivanti is aware of the additional bug and plans to publish a fix "in the coming weeks."

The disclosure of the zero-day this week makes it the third year running that Ivanti has had to deal with attackers exploiting undisclosed flaws in Connect Secure.

The previous ICS zero-days were disclosed in January 2025, a year after the January 2024 vulnerabilities led to exploits affecting thousands of ICS appliances.

In the interim, we've also seen suspected Chinese espionage groups exploiting bugs in Endpoint Manager Mobile (EPMM), and critical flaws in Sentry.

Ivanti's run of January zero-days continued earlier this year, although those flaws affected EPMM rather than Connect Secure. ®