Ivanti Patches a Connect Secure Zero-Day Attackers Were Already Using

Ivanti shipped updates for its Connect Secure VPN on Tuesday to fix CVE-2026-104935, an authentication bypass and remote code execution flaw rated 8.6 on the CVSS scale. It was already being exploited. "We are aware of exploitation in the wild affecting a limited number of customers at the time of disclosure," the company said in its advisory.

Volexity found it. The firm says a previously unknown group it now tracks as UTA0576 started hitting a customer's fully patched appliance (version 22.8R2.4) on October 3, chaining the bypass and code execution bug with a separate privilege escalation flaw to get root. Ivanti says that third bug will be fixed "in the coming weeks." Affected branches include 25.1.1.1, 25.1.2.2 and 22.8R2.4 and earlier.

The attackers went after Active Directory data, LAPS passwords, BitLocker recovery keys and credentials sitting in packet captures, and they wiped Ivanti debug logs and Linux audit logs as they went. No malware or web shells were left behind, since they re-ran the exploit chain for every command. Volexity also says Ivanti's own Integrity Checker Tool doesn't catch this, because the chain patches code in memory only, so a clean scan doesn't mean a clean box.

This is the third year in a row Connect Secure has been hit by attackers using undisclosed flaws.

— via The Register and Volexity